diagnosing-superpowers: drop gh; file issues through a prefilled template link

A default gh login carries the repo scope, which is write access to every
repository the user can reach. The skill now searches issues through the
unauthenticated public API and, instead of posting, hands the partner a
prefilled new-issue link. The link uses a new diagnosis_report.md issue
template so the bug and automated-issue-report labels apply regardless of
the reporter's permissions. Addresses arittr's review on #2236.

.github/ISSUE_TEMPLATE/diagnosis_report.md

@@ -0,0 +1,42 @@
+---
+name: Session Diagnosis Report
+about: A report produced by the diagnosing-superpowers skill from a real session transcript
+labels: bug, automated-issue-report
+---
+
+<!--
+This template is for reports prepared by the diagnosing-superpowers skill.
+The skill fills the sections below from the session transcript and hands
+you a prefilled link; review every line before you submit, and attach the
+scrubbed bundle if you built one. For anything else, use Bug Report.
+-->
+
+- [ ] I searched existing issues and this is not a duplicate
+
+## Environment (required)
+
+| Field | Value |
+|-------|-------|
+| Superpowers version | |
+| Harness (Claude Code, Cursor, etc.) | |
+| Harness version | |
+| Your model + version | |
+| All plugins installed | |
+| OS + shell | |
+
+## Is this a Superpowers issue or a platform issue?
+
+- [ ] I confirmed this issue does not occur without Superpowers installed
+
+## What happened?
+
+## Steps to reproduce
+1.
+2.
+3.
+
+## Expected behavior
+
+## Actual behavior
+
+## Debug log or conversation transcript

docs/superpowers/specs/2026-08-27-diagnosing-superpowers-design.md

@@ -247,19 +247,27 @@ user asks.
 
 1. **Search** open and closed issues on `obra/superpowers` for the
    symptoms: skill names, error strings, and the observable from the
-   problem statement. Use `gh` if it is installed; otherwise the public
-   search API (`https://api.github.com/search/issues`) via curl;
-   otherwise give the user a search URL and stop.
+   problem statement. Use the public search API
+   (`https://api.github.com/search/issues`) via curl, which needs no
+   token and allows 10 requests a minute; otherwise give the user a
+   search URL and stop. The skill never uses `gh`: a default `gh` login
+   carries the `repo` scope, which is write access to every repository
+   the user can reach, far more than this step needs.
 2. **Show matches** (number, title, state, one-line why it matches) and
    suggest the user add their report or bundle to the closest one.
 3. **If nothing matches**, draft an issue from `templates/issue.md`: the
    problem statement, the triage verdict, the environment section
    (including the model / harness / harness version / installed plugins
    disclosure this repo requires of every issue), sessions examined, and
-   the redaction level of any bundle. Show the exact text; create the
-   issue only after the user approves it. `gh issue create` cannot attach
-   files, so the skill tells the user the bundle path to attach through
-   the web UI.
+   the redaction level of any bundle. Write the draft to the workspace,
+   show it, and hand the user a prefilled new-issue link using the repo's
+   `diagnosis_report.md` issue template, which applies the `bug` and
+   `automated-issue-report` labels regardless of the reporter's
+   permissions (the `labels` URL parameter only works for people with
+   triage rights). GitHub caps the URL near 8,000 characters; past that
+   the link carries the title only and the user pastes the body from the
+   file. The user submits the issue and attaches any bundle in the form.
+   The skill never posts to GitHub.
 4. Nothing is posted anywhere without the user approving the exact text.
 
 ### 5. Export (on request)

skills/diagnosing-superpowers/SKILL.md

@@ -47,13 +47,17 @@ Create a todo per step. Steps 5–7 run only on their stated condition.
 4. **Report.** Fill every section of `templates/report.md` in order, write
    it to the workspace, show it, and give the path.
 5. **GitHub issues** — when report §7 says possible or likely, or your
-   partner asks. Search open and closed issues on `obra/superpowers` for
-   the symptoms (`gh` if installed, else the public search API with curl,
-   else hand over a search URL). Show matches and suggest adding the
-   report to the closest. If none match, draft `templates/issue.md`, show
-   the exact text, and create it only after approval. `gh issue create`
-   cannot attach files; if a bundle exists, give your partner its path to
-   attach.
+   partner asks. Never use `gh`: its token usually has write access to
+   every repo your partner can reach. Search open and closed issues for
+   the symptoms with curl against the public API
+   (`https://api.github.com/search/issues?q=repo:obra/superpowers+<terms>`),
+   else hand over a search URL. Show matches and suggest adding the
+   report to the closest. If none match, fill `templates/issue.md`, write
+   it to the workspace, show it, and build a prefilled link:
+   `https://github.com/obra/superpowers/issues/new?template=diagnosis_report.md&title=<encoded>&body=<encoded>`.
+   Over 8,000 characters, send the link with the title only and point at
+   the file to paste. Your partner submits and attaches any bundle in the
+   form; you never post.
 6. **Export** — only when your partner asks for a bundle; never build one
    unprompted. If the intake goal was a bug report, say once that a
    scrubbed bundle is available on request, then wait. Ask the redaction
@@ -96,8 +100,8 @@ Create a todo per step. Steps 5–7 run only on their stated condition.
   waive this; point at the issue step and mention that a bundle is
   available on request. No advice to your partner either.
 - **Approval gates.** No archive before your partner has seen the scrub
-  log and file list. No issue or comment before they approve the exact
-  text.
+  log and file list. You never post to GitHub; your partner submits the
+  prefilled issue themselves.
 - **Intake before analysis.** Nothing in steps 2–7 starts until your
   partner has answered. If they are away, write the questions and stop.
   A statement you reconstructed for them is not an answer. An