feat: native copilot plugin install for superpowers (work, hybrid) [DOT-50]

[edwinhern]

Summary

Give the work GitHub Copilot setup a first-class install for our AI plugins on chezmoi apply, mirroring the Claude Code plugin flow, without touching the Claude path.

• superpowers now installs natively via the Copilot CLI: copilot plugin marketplace add <source> + copilot plugin install <name>@<marketplace>.
• caveman keeps its documented skills path: npx skills add <source> -a github-copilot (no native Copilot plugin exists for it).
• The mechanism is per-plugin, chosen by a new copilot: plugin|skill field on each ai.plugins entry. The Claude Code path is unchanged — it always installs every entry as a native claude plugin and never reads the copilot field.
• The copilot CLI is provisioned work-only via a copilot-cli Homebrew cask; auth relies on the existing GH_TOKEN/gh login on the work box.

Why per-entry, not per-target

Targets are context-gated (personal -> claude-code, work -> github-copilot), so a single caveman entry installs as a Claude plugin on personal and a Copilot skill on work. The install mechanism lives on the plugin entry and is read only by the Copilot installer; Claude's installer has one mechanism and ignores the hint.

Behavior notes

• Copilot install is now soft-fail per entry: a missing copilot or npx fails only that plugin (warned in the summary), so one broken mechanism never blocks the other or aborts chezmoi apply. The Claude path still hard-fails if claude is missing.

Testing

• mise test — all green (added Copilot plugin-mechanism routing tests with a mocked copilot CLI; both-mechanisms-together; missing-CLI isolation; updated fixtures to the 4-field format).
• mise lint — clean (treefmt, shellcheck, actionlint).
• Template render tests assert copilot-cli renders for work and not personal, and the 4-field AI_PLUGINS serialization.

Verify on the work box

obra/superpowers is reused as the Copilot marketplace (same triple Claude uses). Confirm once that copilot plugin install superpowers@superpowers-dev resolves there.

Fixes DOT-50

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.