diagnosing-superpowers: use gh for issue search and creation

gh handles auth, rate limits, and JSON, and the approval gate on the
exact issue text already covers posting. Keep the public-API and
prefilled-link paths as fallbacks for machines without gh. Note that
GitHub drops labels from reporters without push access, so the template
footer is the durable marker of a skill-filed issue.

docs/superpowers/specs/2026-08-27-diagnosing-superpowers-design.md

@@ -248,27 +248,24 @@ user asks.
 
 1. **Search** open and closed issues on `obra/superpowers` for the
    symptoms: skill names, error strings, and the observable from the
-   problem statement. Use the public search API
-   (`https://api.github.com/search/issues`) via curl, which needs no
-   token and allows 10 requests a minute; otherwise give the user a
-   search URL and stop. The skill never uses `gh`: a default `gh` login
-   carries the `repo` scope, which is write access to every repository
-   the user can reach, far more than this step needs.
+   problem statement. Use `gh` if it is installed; otherwise the public
+   search API (`https://api.github.com/search/issues`) via curl;
+   otherwise give the user a search URL and stop.
 2. **Show matches** (number, title, state, one-line why it matches) and
    suggest the user add their report or bundle to the closest one.
 3. **If nothing matches**, draft an issue from `templates/issue.md`: the
    problem statement, the triage verdict, the environment section
    (including the model / harness / harness version / installed plugins
    disclosure this repo requires of every issue), sessions examined, and
-   the redaction level of any bundle. Write the draft to the workspace,
-   show it, and hand the user a prefilled new-issue link using the repo's
-   `diagnosis_report.md` issue template, which applies the `bug` and
-   `automated-issue-report` labels regardless of the reporter's
-   permissions (the `labels` URL parameter only works for people with
-   triage rights). GitHub caps the URL near 8,000 characters; past that
-   the link carries the title only and the user pastes the body from the
-   file. The user submits the issue and attaches any bundle in the form.
-   The skill never posts to GitHub.
+   the redaction level of any bundle. Show the exact text; create the
+   issue with `gh issue create` only after the user approves it, with the
+   `bug` and `automated-issue-report` labels. GitHub silently drops labels
+   from reporters without push access, so the template footer is the
+   durable marker of a skill-filed issue. `gh` cannot attach files, so the
+   skill tells the user the bundle path to attach through the web UI.
+   Without `gh`, the skill hands over a prefilled new-issue link on the
+   `diagnosis_report.md` template, which applies both labels for any
+   reporter; GitHub caps that URL near 8,000 characters.
 4. Nothing is posted anywhere without the user approving the exact text.
 
 ### 5. Export (on request)

skills/diagnosing-superpowers/SKILL.md

@@ -47,13 +47,12 @@ Create a todo per step. Steps 5–7 run only on their stated condition.
 4. **Report.** Fill every section of `templates/report.md` in order, write
    it to the workspace, show it, and give the path.
 5. **GitHub issues** — when report §7 says possible or likely, or your
-   partner asks. Never use `gh`: its token usually has write access to
-   every repo your partner can reach. Search open and closed issues for
-   the symptoms with the public API per `references/github-issues.md`.
-   Show matches and suggest adding the report to the closest. If none
-   match, fill `templates/issue.md`, write it to the workspace, show it,
-   and hand over the prefilled link from that reference. Your partner
-   submits and attaches any bundle in the form; you never post.
+   partner asks. Search open and closed issues for the symptoms per
+   `references/github-issues.md`. Show matches and suggest adding the
+   report to the closest. If none match, fill `templates/issue.md`, write
+   it to the workspace, show the exact text, and create the issue only
+   after approval. `gh` cannot attach files; if a bundle exists, give
+   your partner its path to attach in the browser.
 6. **Export** — only when your partner asks for a bundle; never build one
    unprompted. If the intake goal was a bug report, say once that a
    scrubbed bundle is available on request, then wait. Ask the redaction
@@ -100,8 +99,8 @@ yourself in step 3 and which findings to lead with in the verdict.
   mention that a bundle is available on request. No advice to your
   partner either.
 - **Approval gates.** No archive before your partner has seen the scrub
-  log and file list. You never post to GitHub; your partner submits the
-  prefilled issue themselves.
+  log and file list. No issue or comment before they approve the exact
+  text.
 - **Intake before analysis.** Nothing in steps 2–7 starts until your
   partner has answered. If they are away, write the questions and stop.
   A statement you reconstructed for them is not an answer. An

skills/diagnosing-superpowers/references/github-issues.md

@@ -1,12 +1,17 @@
-# GitHub issues without `gh`
+# GitHub issues
 
-A default `gh` login carries the `repo` scope: write access to every
-repository your human partner can reach. This step needs none of that, so
-it uses the public API and the browser.
+Use `gh` when it is installed and authenticated; it handles auth, rate
+limits, and JSON. Fall back to the public API with curl, then to a URL
+your partner opens.
 
 ## Search
 
-Unauthenticated, 10 requests a minute. Search open and closed issues:
+```bash
+gh search issues --repo obra/superpowers --limit 10 "<terms>" \
+  --json number,state,title --jq '.[] | "\(.number)\t\(.state)\t\(.title)"'
+```
+
+Without `gh` (unauthenticated, 10 requests a minute):
 
 ```bash
 curl -s -H "Accept: application/vnd.github+json" \
@@ -14,21 +19,29 @@ curl -s -H "Accept: application/vnd.github+json" \
   | jq -r '.items[] | "\(.number)\t\(.state)\t\(.title)"'
 ```
 
-If curl is unavailable, hand over the search URL instead:
-`https://github.com/obra/superpowers/issues?q=<terms>`.
+Without curl, hand over `https://github.com/obra/superpowers/issues?q=<terms>`.
 
 ## File
 
-Write the filled `templates/issue.md` to the workspace, then build the
-link. The `diagnosis_report.md` template applies the `bug` and
-`automated-issue-report` labels for any reporter; the `labels=` parameter
-would not.
+Write the filled `templates/issue.md` to the workspace and show the exact
+text. After approval:
+
+```bash
+gh issue create --repo obra/superpowers --title "<title>" --body-file <path> \
+  --label bug --label automated-issue-report
+```
+
+GitHub drops labels silently when the reporter lacks push access, so the
+labels land only for collaborators; the template footer still marks the
+issue as skill-filed. `gh` cannot attach files: give your partner the
+bundle path to attach through the browser after the issue exists.
+
+Without `gh`, hand over a prefilled link on the `diagnosis_report.md`
+template, which applies both labels for any reporter:
 
 ```
 https://github.com/obra/superpowers/issues/new?template=diagnosis_report.md&title=<url-encoded title>&body=<url-encoded body>
 ```
 
-GitHub rejects URLs over about 8,000 characters. If the link exceeds
-that, send it with the title only and tell your partner to paste the body
-from the file. Your partner submits the issue and attaches any bundle in
-the form.
+GitHub rejects URLs over about 8,000 characters; past that, send the link
+with the title only and tell your partner to paste the body from the file.