feat: Read My Mind phase 1, per-case intent profiles (capture + API + skill)

Per-case profiles of user intent (docs/readmymind-plan.md): user-stated goals
plus the user's recently submitted prompts, captured from the Claude session
transcript behind the new synced readMyMindEnabled setting (default OFF).

- intent-store.ts: keyed by owner + realpath(workingDir), FIFO/size caps,
  consecutive-dupe collapse, atomic 0600 writes to ~/.codeman/intents.json
- transcript-watcher.ts: new transcript:user_prompt event for typed user turns
  (tool_result-only entries stay silent); capture wiring in server.ts is
  claude-only and gated on the setting per event
- readmymind-routes.ts: GET/PUT/DELETE /api/sessions/:id/intent, ownership
  via findSessionOrFail, strict Zod schema
- agent skill: SKILL.md recipe + endpoints.md rows so agents can read and
  record intent (PUT replaces: read + merge; never delete unprompted)
- groundwork for the phase-2 predictor button; nothing is ever auto-sent

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

skills/codeman/SKILL.md

@@ -392,6 +392,24 @@ is parked resolves it within ~3 s. A session deleted mid-wait resolves in ~1 s.
 delete_session "$SID"
 ```
 
+**Read My Mind: read and record the user's intent.** Each case has an intent
+profile: user-stated goals plus the user's recent real prompts (captured
+server-side while the opt-in `readMyMindEnabled` setting is on). Read it to
+ground your work in what the user actually wants; write it when the user states
+an intention worth remembering ("the goal is shipping 1.17"):
+
+```bash
+"${CURL[@]}" "$API/api/v1/sessions/$SELF/intent" | jq '.data.intent'
+"${CURL[@]}" -X PUT -H 'Content-Type: application/json' \
+  -d '{"goals":"shipping 1.17; mobile polish next"}' "$API/api/v1/sessions/$SELF/intent"
+```
+
+⚠️ PUT **replaces** the whole goals text: read it first and merge, never
+blind-write. Never write goals the user did not state, and never delete the
+profile (`DELETE .../intent`) unless the user asks: it is their memory, not
+yours. Older servers 404 these routes; treat that as "feature absent", not an
+error.
+
 Everything else (endpoint tables, per-mode signal table, error codes, capacity
 limits, Docker/remote caveats): [reference/endpoints.md](reference/endpoints.md).
 Fan-out orchestration and blocked-worker handling:

skills/codeman/reference/endpoints.md

@@ -47,6 +47,9 @@ read the status with `-w '%{http_code}'` and the raw body before assuming a bug.
 | full tmux scrollback (context bomb; post-mortems only) | `GET /api/v1/sessions/:id/terminal?full=1` |
 | background agents, one session | `GET /api/v1/sessions/:id/subagents` |
 | background agents, global list | `GET /api/v1/subagents` (admin-only in multi-user mode) |
+| the case's intent profile (Read My Mind: user goals + recent real prompts) | `GET /api/v1/sessions/:id/intent` → `.data.intent.{goals,recentPrompts}` (empty with `updatedAt: 0` until something is recorded) |
+| replace the user-goals text on the case's intent profile | `PUT /api/v1/sessions/:id/intent` body `{"goals":"…"}` (≤ 8192 chars, strict schema; REPLACES the text, read + merge first) |
+| forget the case's intent profile (only when the user asks) | `DELETE /api/v1/sessions/:id/intent` → `.data.deleted` |
 | server status / version | `GET /api/v1/status` → `.data.version` |
 | delete one session (yours only, via `delete_session`) | `DELETE /api/v1/sessions/:id` — never call it bare; the fail-closed helper in SKILL.md §0 is the only self-protection that exists. Answers `{"success":true,"data":{}}`: an **empty** body is the success signal, there is nothing to read back |