docs(plans): add dogfooding-gap audit of shipped guardrails

[maybebyte]

Summary

This repo is a Copier template whose value proposition is the guardrail suite it forces on every downstream project, but several of those gates never run on the maintainer repo itself. This adds an audit that inventories the dogfooding gaps so we can bring the repo in line with its "practice what we ship" goal.

Changes

• Add docs/superpowers/plans/2026-07-01-dogfood-gap-audit.md: nine confirmed gaps (pre-commit, gitleaks/semgrep scanners, dependency-audit, policy-tests, renovate, editorconfig, aggregate just ci, sha-pin comment gate, property-tests), the guardrails ruled not-applicable (mutation-tests, coverage-floor) with rationale, net-new practice candidates, and a prioritized wiring sequence.
• Documentation only — no tooling, config, or code paths change.

Testing

• None run: the change adds a single Markdown doc with no executable surface. Existing CI (lint/typecheck/test/zizmor) is unaffected.

Notes for reviewers

• The report is advisory; it wires nothing. Follow-on PRs implement the sequence — pre-commit first (flagged), gitleaks/semgrep is the one substantive security gap.
• Worth a sanity check: the not-applicable calls (mutation/coverage on the test harness) and the gap priorities, plus the "mirror, don't diverge" principle (net-new items get a copier toggle in the template before being dogfooded).