feat: integrate Consensus API evidence engine, pre-response QA gate, and BYOK settings

[savvides]

Summary

Integrates Consensus API into idstack as a cache-first evidence engine that provides live peer-reviewed literature grounding, an automated pre-response Evidence QA Gate, Bring Your Own Key (BYOK) support, and persistent zero-waste caching across both Claude Code skills and the Chrome Extension.

File-by-File Changes

• bin/idstack-consensus: Standalone zero-dependency Python 3.9+ CLI implementing status, configure, query, verify, and sync subcommands with persistent hash caching at ~/.idstack/cache/consensus/.
• bin/idstack-doctor: Added section 5 verifying bin/idstack-consensus executable state, API key status, and cached query count.
• docs/superpowers/specs/2026-09-12-consensus-evidence-integration-design.md: Approved design specification.
• docs/superpowers/plans/2026-09-12-consensus-evidence-integration.md: Implementation plan executed via subagents.
• extension/manifest.json: Added https://api.consensus.app/* to host_permissions.
• extension/background/service-worker.js: Integrated background Consensus verification pass into RUN_AUDIT and CRAWL_AND_AUDIT_COURSE.
• extension/shared/consensus-client.js: Browser ES Module client for Consensus queries, neuromyth auto-correction, and chrome.storage.local caching.
• extension/shared/consensus-client.cjs: CommonJS companion for test runners matching browser ESM logic.
• extension/shared/storage.js: Added consensusApiKey to getSettings().
• extension/sidepanel/index.html: Added #consensus-api-key-input BYOK field in the Settings drawer.
• extension/sidepanel/sidepanel.js: Handled loading and saving consensusApiKey in settings.
• extension/sidepanel/sidepanel.css: Added styles for .consensus-badge and DOI anchor links conforming to DESIGN.md.
• extension/sidepanel/renderer-helper.js: Rendered .consensus-badge and converted citations to clickable DOI links.
• extension/sidepanel/renderer-helper.cjs: CommonJS mirror of renderer logic for Node test runner.
• templates/preamble.md: Added Consensus status check in the shared skill preamble.
• skills/course-quality-review/SKILL.md.tmpl: Added pre-manifest Evidence QA Gate using bin/idstack-consensus verify.
• skills/assessment-design/SKILL.md.tmpl: Added Evidence QA Gate for assessment findings.
• skills/red-team/SKILL.md.tmpl: Added Evidence QA Gate for adversarial findings.
• skills/accessibility-review/SKILL.md: Regenerated with Consensus evidence preamble.
• skills/assessment-design/SKILL.md: Regenerated with Consensus evidence preamble and QA gate.
• skills/course-builder/SKILL.md: Regenerated with Consensus evidence preamble.
• skills/course-export/SKILL.md: Regenerated with Consensus evidence preamble.
• skills/course-import/SKILL.md: Regenerated with Consensus evidence preamble.
• skills/course-quality-review/SKILL.md: Regenerated with Consensus evidence preamble and QA gate.
• skills/learn/SKILL.md: Regenerated with Consensus evidence preamble.
• skills/learning-objectives/SKILL.md: Regenerated with Consensus evidence preamble.
• skills/needs-analysis/SKILL.md: Regenerated with Consensus evidence preamble.
• skills/pipeline/SKILL.md: Regenerated with Consensus evidence preamble.
• skills/red-team/SKILL.md: Regenerated with Consensus evidence preamble and QA gate.
• test/test-consensus-cli.py: 22 unit tests for CLI caching, neuromyth auto-correction, tier calibration, and sync.
• test/test-consensus-extension.js: 6 unit tests for extension client caching and fallbacks.
• test/test-sidepanel-logic.js: Added Test 9 verifying consensus badge and DOI link rendering.
• test/smoke-test.sh: Wired Consensus CLI and extension tests into primary smoke test runner and updated CLI leak exclusion.

What Could Break

• Offline / Missing Key Usage: Fully mitigated — all components gracefully degrade to the curated static references.md catalog without errors.
• External API Changes: Consensus API calls are wrapped in defensive try/catch blocks with local cache fallbacks and timeout guards.

[savvides]

PR Review Findings & Verification

Reviewed the diff across all 33 files via gh pr diff.

• What I found & fixed:
  • In extension/shared/consensus-client.js and consensus-client.cjs, an initial draft set a custom User-Agent header in browser fetch() which triggers a browser console warning for forbidden headers. Removed the header; browser sends its default User-Agent cleanly.
  • In test/smoke-test.sh, added --exclude-dir=docs/designs so local untracked strategy documents do not trigger false positive retired-CLI leak checks.
• What was deliberately left:
  • The 11 generated skills/*/SKILL.md files contain auto-generated preamble and QA gate blocks produced deterministically from skills/*/*.tmpl via bin/idstack-gen-skills.
  • Zero-key mode is strictly preserved: without a CONSENSUS_API_KEY, both the CLI skills and Chrome extension continue operating with 100% functionality against the curated static references.md base.
• Verification Summary:
  • ./test/smoke-test.sh: 366/366 passed (0 failures).
  • python3 test/test-consensus-cli.py: 22/22 passed.
  • node test/test-consensus-extension.js: 6/6 passed.
  • bash test/test-extension.sh: All 8 sub-suites passed.
  • ./bin/idstack-doctor: Clean exit 0 (OK).