feat(ai-autopilot): built-in prompts library (#111)

[suleimansh]

Closes #111. Child of the AI-framework epic #110; supplies the bodies the loop (#113) dispatches and consults the decisions ledger (#112). This closes the turnkey wire across all three.

What

The stack-aware prompt bodies, shipped as data. Eight markdown bundles under prompts/ (published in the tarball):

• review (TLDR + thorough), code-quality, security, refactor, UX, QA, knowledge-base
• Each already knows Vike + universal-orm (authz/IDOR scoping, server/client boundary, ORM N+1, SSR/hydration, ...).
• Frontmatter is parsed by @gemstack/ai-skills (metadata.loopId / passes / event), so a contributor improves a prompt by editing prose, not code (the main OSS contribution surface).

Loaded with builtinLibrary() / loadPromptsFrom(dir) into a PromptLibrary. loopPromptsFor(library, makeAgent) materializes them into loop prompts so defaultLoopRules() ids (review/code-quality/security/qa/ux) resolve to real bodies, a fresh agent per pass. promptInstructions composes a body with the decisions briefing; renderTask turns a LoopEvent into the worker's task.

The turnkey wire (what this unlocks)

const library = await builtinLibrary()
const loop = new Loop({
  rules: defaultLoopRules(),
  prompts: loopPromptsFor(library, ctx => agent({ instructions: ctx.instructions, tools: runnerTools(session) })),
  ledger,
})
await loop.handle({ kind: 'major-change', summary: 'reworked auth', paths: ['src/auth/*'] })

Design notes

• Bodies are .md files loaded at runtime relative to the module (../../prompts/), added to files and verified present in npm pack. Works in dev, test, and a published install.
• The prompt id vs name split lets review-thorough dispatch as review while review-tldr stays a standalone body.
• Landscape note on Built-in prompts library (review, quality, security, refactor, UX, QA, knowledge base) #111 stands (prompts are the on-ramp, not the moat); kept as data so the community grows them.

Verification

• 128 tests pass (12 new: parse/library/bridge), typecheck + build clean, npm pack includes all 8 prompts/*.md.
• Drove the full wire against the built dist: builtinLibrary loads all 8 bodies from disk, a major-change event fires review (2 fresh passes) + code-quality + security, ui-flow fires qa + ux, each composed with the decisions briefing.