Migrate 'PostHog SDK defaults' agent guidance from wizard commandment to shared skill doc

[sarahxsanders]

Why

The wizard currently carries an agent commandment in src/lib/agent/commandments.ts telling the agent not to disable PostHog data-capture defaults (autocapture, session_recording, opt_out_capturing in init config). That's product-specific guidance baked into wizard infrastructure — the wizard's design rule says product knowledge lives in skills.

This is distinct from #173 (which tracks the L2 scanner rules). This issue is about the L0 agent guidance — the textual rule the agent reads before it writes anything.

What needs to happen

1. Add a shared doc (working name: libraries/js/defaults.md or similar) covering:
   • autocapture: false — only legitimate with explicit user opt-in
   • disable_session_recording: true / disableSessionRecording: true — same
   • opt_out_capturing: true / opted_out: true in init config — disallowed
   • Legitimate runtime form posthog.opt_out_capturing() for GDPR consent — clearly OK
2. Have the skills that touch init config (posthog-integration, pii-bouncer, possibly others) pull it via shared_docs
3. Once the skill-side guidance is live, remove the commandment from the wizard's commandments.ts

Related

• wizard PR (the warlock migration) restored this commandment as a transitional L0 fix
• Add skill for PostHog config defaults (autocapture / session recording / opt-out) #173 — L2 scanner skill
• Add wizard-owned L2 ruleset for PostHog config defaults (autocapture / session recording / opt-out) wizard#592 — wizard-owned L2 ruleset

🤖 Generated with Claude Code