feat: /idd-edit runtime enforcement (R4 + R5) via extracted helper script (#154)

[kiki830621]

Refs #154 Refs #150 Refs #155 Refs #156 Refs #157 Refs #158

Summary

Closes #150 Requirements 4 + 5 runtime enforcement deferral, addressing R1/R2/R3 bash-incremental failure on PR #153 (3 verify iterations each introduced new parser bugs).

Approach (per #154 D1-D3 plan-locked decisions):

• D1 PR path — this branch (idd/154-edit-runtime)
• D2 Q4 errata flow — refuse-with-helpful-message (NOT auto-override per IC_R007 user-authored-intent spirit)
• D3 [infra] IDD plugin test framework — adversarial fixtures for SKILL.md regression coverage (sister concern from #154) #156 test framework — ad-hoc shell test runner this PR + [infra] IDD plugin test framework — adversarial fixtures for SKILL.md regression coverage (sister concern from #154) #156 generalizes later

Mid-impl pivot per .claude/scripts/tests/spectra-archive-post-ic/ precedent: extract parser to .claude/scripts/idd-edit-helper.sh (proper extracted helper) instead of inline SKILL.md bash. This solves R1/R2/R3 root cause more deeply — AI no longer generates parser bash inline.

What lands

Surface	Change
.claude/scripts/idd-edit-helper.sh	NEW: 3 subcommands (parse-args / validate-target / section-replace), 373 lines, 5 distinct exit codes
.claude/scripts/tests/idd-edit/	NEW: fixture-dir test runner + 13 fixtures covering R1/R2/R3 regression set + R4/R5 gate cases
.../skills/idd-edit/SKILL.md	Step 1+2 use helper; Step 4 --replace uses section-replace helper; argument-hint + 5 usage examples + Batch mode note
.../skills/idd-comment/SKILL.md	errata Template SPECIAL BEHAVIOUR handles R5 exit 4 with helpful manual-invocation message
openspec/specs/append-vs-modify-discipline/spec.md	Purpose + R4 + R5 preambles: "deferred to #154" → "landed via #154" + tested-by fixture refs
plugin.json	2.74.0 → 2.75.0
CHANGELOG.md	[2.75.0] entry with 8 Added / 6 Refactored / 2 BREAKING markers

Test gate proof

$ bash .claude/scripts/tests/idd-edit/test.sh
PASS   01-scope-eq                       (eq form)
PASS   02-scope-space                    (space form)
PASS   03-scope-last-arg                 (R3 C1: --scope as last arg → exit 2)
PASS   04-scope-eats-next-flag           (R3 C2: --scope --body → exit 2)
PASS   05-body-file-missing              (R3 H1: unreadable → exit 5)
PASS   06-multi-line-body                (R3 C3: BSD awk newline OK)
PASS   07-single-line-body
PASS   08-section-with-subs              (R2 B3-NEW-3: stop at next ## not ###)
PASS   09-section-no-closing-heading     (EOF as section end)
PASS   10-replace-no-scope               (R4 gate: exit 3)
PASS   11-non-owner-no-override          (OVERRIDE=false default)
PASS   12-non-owner-with-override        (override requires --reason → exit 2)
PASS   13-errata-refuse-message          (override+reason succeeds)

Results: 13 passed, 0 failed

BREAKING (runtime)

• /idd-edit --replace without --scope/--section now refuses (exit 3 + R4 message)
• /idd-edit modifying non-OWNER non-bot comment now refuses (exit 4 + R5 message); /idd-comment errata flow auto-call handles gracefully

Checklist

• Diagnose (comment)
• Plan (comment) — EnterPlanMode approved
• Implement (1 commit: ce0adf4)
• Verify (run /idd-verify --pr <this-PR>)
• Verify-gated: post-verify PASS = ready to merge → /idd-close #154 after merge

Filed mid-impl

• [META] /idd-edit + IDD skills: bash vs alternative layer for strict flag parsing (sister concern from #154) #155 — bash vs alternative layer (parking-lot P3; helper extraction proves bash + thin SKILL.md orchestration works → lowers urgency)
• [infra] IDD plugin test framework — adversarial fixtures for SKILL.md regression coverage (sister concern from #154) #156 — IDD plugin test framework (P2 — partially pre-empted by reusing precedent for [feature] /idd-edit runtime enforcement — proper proposal after 3-iteration bash failure (R1/R2/R3 on #153) #154)
• [infra] spec.md <!-- @trace --> blocks lack auto-update mechanism (tangential from #154 plan) #157 — spec.md <!-- @trace --> blocks no auto-updater (parking-lot P3)
• [design] /idd-edit batch mode + R5 refuse interaction — semantic decision needed (tangential from #154 plan) #158 — /idd-edit batch mode + R5 interaction semantics (P2; single-target enforcement shipped, batch interaction follow-up)

---

Generated by /idd-implement on PR path. Do NOT add a GitHub close trailer (Closes/Fixes/Resolves) — IDD discipline requires manual /idd-close after merge to enforce checklist gate + closing summary.