fix(brain-allowlist): sync project-root design and test-plan artifacts

Fixes #1452.

`/office-hours` Builder, `/plan-eng-review`, and `/autoplan` write their
output at the project root, not under `designs/`:

  projects/{slug}/{user}-{branch}-design-{datetime}.md
  projects/{slug}/{user}-{branch}-test-plan-{datetime}.md
  projects/{slug}/{user}-{branch}-eng-review-test-plan-{datetime}.md

The `.brain-allowlist` generated by `gstack-artifacts-init` covers
`projects/*/designs/*.md` and the `ceo-plans/` paths, so CEO plans
sync correctly but the design / test-plan artifacts they reference do
not. Pull on machine B and you get the CEO plan but not the underlying
design, breaking the cross-machine plan-references-design chain.

Add three root-anchored globs to the managed block of `.brain-allowlist`:

  projects/*/*-design-*.md
  projects/*/*-test-plan-*.md
  projects/*/*-eng-review-test-plan-*.md

The `*` glob doesn't match path separators, so these patterns are
disjoint from the existing `designs/*.md` patterns — no double-sync,
no churn for installs that already had the subdirectory layout.

Mirror the three patterns in `.brain-privacy-map.json` with
`"class": "artifact"`, matching how the existing `designs/*.md`
patterns are classified there, so the same privacy semantics apply.

Same class of incomplete-rename bug as #1441 (v1.27.0.0 missed the
config key in one place); this audit covers the allowlist surface.

Author: genisis0x

bin/gstack-artifacts-init

@@ -227,6 +227,18 @@ projects/*/ceo-plans/*.md
 projects/*/ceo-plans/*/*.md
 projects/*/designs/*.md
 projects/*/designs/*/*.md
+# Project-root design / test-plan artifacts written by /office-hours,
+# /plan-eng-review, and /autoplan. The skills emit
+# `{user}-{branch}-design-{datetime}.md`,
+# `{user}-{branch}-test-plan-{datetime}.md`, and
+# `{user}-{branch}-eng-review-test-plan-{datetime}.md` at the project
+# root (not under designs/), so the existing `designs/*.md` patterns
+# miss them. Without these the cross-machine pull on machine B gets
+# the referencing CEO plan but not the underlying design / test plan
+# (#1452).
+projects/*/*-design-*.md
+projects/*/*-test-plan-*.md
+projects/*/*-eng-review-test-plan-*.md
 projects/*/timeline.jsonl
 retros/*.md
 developer-profile.json
@@ -247,6 +259,9 @@ cat > "$GSTACK_HOME/.brain-privacy-map.json" <<'EOF'
   {"pattern": "projects/*/ceo-plans/*/*.md", "class": "artifact"},
   {"pattern": "projects/*/designs/*.md", "class": "artifact"},
   {"pattern": "projects/*/designs/*/*.md", "class": "artifact"},
+  {"pattern": "projects/*/*-design-*.md", "class": "artifact"},
+  {"pattern": "projects/*/*-test-plan-*.md", "class": "artifact"},
+  {"pattern": "projects/*/*-eng-review-test-plan-*.md", "class": "artifact"},
   {"pattern": "retros/*.md", "class": "artifact"},
   {"pattern": "builder-journey.md", "class": "artifact"},
   {"pattern": "projects/*/timeline.jsonl", "class": "behavioral"},