fix(002): drop template docs-website spec + deploy workflow from produced apps

[bartekus]

Problem

New project creation was fully blocked. Every scaffold failed at stagecraft's per-request regenerateProducedIndex fail-closed gate:

index is STALE ... stale shard(s): by-spec/016-docs-website (blocking diagnostics)
(scaffold job ... orphaned — operator reclaim)

Root cause

#25 (3d900fd) stripped website/ from produced apps but left template-encore's spec 016-docs-website, which establishes: ["website/", ".github/workflows/deploy-docs.yml"]. The born-with specs/ carry-forward drop only consulted GENERATOR_META_SPEC_IDS (factory-encore's own slugs, which never match a baseline slug), so every produced app carried spec 016 while website/ was gone. The produced app's own spec-spine index then emitted I-004 for the missing website/ unit and index check correctly failed closed. This was a genuine spec/code drift from the incomplete #25 cleanup; the stagecraft gate did its job.

Fix

• born-with.ts: add TEMPLATE_DEV_SPEC_IDS (016-docs-website), consulted alongside GENERATOR_META_SPEC_IDS in classifyEntry's specs/ branch.
• setup-app.ts: drop the orphaned .github/workflows/deploy-docs.yml in the copy walk (every other workflow stays born-with the app).
• fixture + setup-app.test.ts: seed the spec + a kept/dropped workflow pair, with negative assertions.
• amend spec 002; regenerate the 002 registry + index shards.

Verification

• Produced tree now passes compile → index → index check: 0 diagnostics, "index is fresh", exit 0 (was exit 2).
• Full adapter suite 186/186.

[github-actions]

AI Code Review

Now I have what I need. Here is the review.

---

PR Review: drop template docs-website spec + deploy workflow

Bugs / Logic Errors

Split enforcement of the template-dev invariant (born-with.ts + copyBaseline). A template-dev spec's cleanup requires two independent, non-adjacent changes:

1. Add the spec ID to TEMPLATE_DEV_SPEC_IDS (born-with.ts) -- drops specs/<id>/.
2. Add an ad-hoc filename skip in copyBaseline (setup-app.ts) -- drops established workflow files.

The TEMPLATE_DEV_SPEC_IDS comment says the set is "guarded by setup-app.test.ts", but that guard only covers the spec-directory drop. The corresponding copyBaseline skip for associated workflow files has no analogous mechanical guard -- only the 016 case is tested. A future contributor who adds a new template-dev spec to TEMPLATE_DEV_SPEC_IDS will see the comment referencing the test guard and be led to believe the spec side is sufficient, potentially omitting the copyBaseline skip for whatever other artifacts the spec establishes:. The Amendment's "Invariant for the future" paragraph only mentions TEMPLATE_DEV_SPEC_IDS, not the workflow skip.

Recommendation: Extend the invariant note in both the TEMPLATE_DEV_SPEC_IDS JSDoc and the spec Amendment to explicitly state that established workflow files require a corresponding ad-hoc skip in copyBaseline.

---

classifyEntry reports deploy-docs.yml as 'app' -- the classification system is bypassed. A reader auditing born-with.ts alone would conclude that .github/workflows/deploy-docs.yml is carried. The actual skip lives in copyBaseline as an ad-hoc guard alongside docs/encore-ts / docs/migration. This is internally consistent with the existing pattern for template-dev docs, but the policy split means the classification system is no longer a complete description of what gets carried. No current bug; it is a correctness risk for future audits.

---

Security Vulnerabilities

None introduced. The rel-based path guard uses basenames from readdirSync -- filenames cannot carry ../ components. path.join(srcDir, name) / path.join(destDir, name) are safe. Symlinks are explicitly ignored. The resolveSource path.resolve() normalizes --source and TEMPLATE_ENCORE_SOURCE but does not restrict to safe roots; this is pre-existing and acceptable for a developer CLI tool.

---

Spec-spine Compliance

Coupling gate: followed. specs/002-encore-generator-core/spec.md gains the 2026-07-10 Amendment. The changed code paths (born-with.ts, setup-app.ts) are both owned by spec 002. Derived artifacts (by-spec/002-encore-generator-core.json in both .derived/ trees) have updated shardHash values. No spec-claimed code path was changed without its owning spec.

Cross-repo drift risk (design limitation, not a violation). TEMPLATE_DEV_SPEC_IDS embeds 016-docs-website -- a template-encore spec that does not exist under this repo's specs/. There is no factory-encore CI path that can verify the entry is still current after a lockstep ref bump. If template-encore later adds 017-something-template-dev and the baseline ref is updated, nothing in factory-encore's CI catches the missing TEMPLATE_DEV_SPEC_IDS entry; the I-004 failure reproduces at scaffold time. This is a structural gap that cannot be closed within this repo alone, but the Amendment should acknowledge it explicitly so the next lockstep-ref update includes a manual check.

Registry sections list: Both Amendment lines are appended correctly to the sections array in the spec registry JSON. ✓

---

Generator Determinism and Lockstep Invariants

Determinism: classifyEntry is pure. The new rel.length === 3 && rel[0] === '.github' && rel[1] === 'workflows' && name === 'deploy-docs.yml' guard is deterministic. (rel.length === 3 is redundant given the three field checks that already pin the exact path, but harmless.) ✓

Born-with completeness: After this PR all three artifacts spec 016 establishes: are dropped: website/ (GENERATOR_ARTIFACT_TOP_LEVEL, prior PR), specs/016-docs-website/ (TEMPLATE_DEV_SPEC_IDS, this PR), .github/workflows/deploy-docs.yml (copyBaseline skip, this PR). The I-004 reproduction path is closed. ✓

Lockstep: baseline.lock.json is not modified. The lockstep check pins the template-encore ref and specific file hashes; it does not track which files copyBaseline skips, so no lockstep update is required for adding a skip rule. ✓

Fixture coverage: makeBaselineFixture seeds both ci-supply-chain.yml (carried) and deploy-docs.yml (dropped), specs/016-docs-website (dropped). The negative assertions in setup-app.test.ts exercise both the spec-drop and the workflow-drop paths. ✓

---

Summary

One real maintenance hazard: the invariant for TEMPLATE_DEV_SPEC_IDS is documented incompletely -- it says "add to TEMPLATE_DEV_SPEC_IDS", but the full requirement is "add to TEMPLATE_DEV_SPEC_IDS and add a copyBaseline skip for each established non-spec artifact". The Amendment and the JSDoc comment both need this spelled out. The cross-repo drift risk for future template-dev specs is also worth acknowledging explicitly in the Amendment. No security issues; coupling gate is clean; correctness for the current case is solid.

---

Automated review by Claude. Diff size: 100 lines.