docs(sandcastle): decomposer + reviewer enforce vertical-slice tasks

The user surfaced that the binder-wrap-helper epic's stories
decomposed into horizontal sub-steps (read 3 files → write helper
→ write test → export → typecheck → coverage), not vertical
slices. Per the glossary's slice = task = PR = commit rule, every
checkbox should land as one green commit.

.sandcastle/decomposer.prompt.md:
  - New "The slice rule (non-negotiable)" section near the top
    defining the three constraints every task must satisfy: one
    green commit; exercises a layer; independently meaningful.
  - New "Tasks that are FORBIDDEN" list naming the anti-patterns
    the previous output exhibited (read a file as a task; write
    test without impl; standalone gate runs; standalone export;
    sub-step decomposition of a single slice).
  - New "Tasks that are CORRECT" list with examples drawn from
    this codebase (gen invocation, full use-case slice, per-feature
    binder migration, audit emission, bindAll wiring).
  - New paragraph on "Manifest-first ordering INSIDE a task" —
    the 4-step ordering (manifest → contracts → red test → green
    impl) is what the implementer does within one task, not a
    multi-checkbox decomposition.
  - Constraints section gains two new bullets:
      * Prefer FEWER but FATTER tasks (one per vertical slice)
        over MANY thinner sub-steps
      * Self-check: imagine the commit each checkbox produces;
        do all gates pass on that commit alone?

.sandcastle/reviewer.prompt.md:
  - New check #8 "Slice discipline" rejecting:
      * Multi-commit diffs where any intermediate commit has red
        gates
      * Sub-step shape that should have been separate tasks
      * Incomplete slices (use case w/o DI binding, manifest
        publish w/o publish site, controller w/o router wiring)

.gitignore: adds `.pnpm-store/` so a misconfigured pnpm install
that places the store inside the project doesn't stage thousands
of cache files.

The existing binder-wrap-helper stories were decomposed under the
old (unconstrained) prompt and need re-decomposing under the new
rule. That's a separate action — this commit fixes the prompts;
the existing epic stays as-is until you re-decompose.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitignore

@@ -1,6 +1,12 @@
 # Dependencies
 node_modules
 
+# pnpm's content-addressable store (only present when a misconfigured
+# pnpm install places the store inside the project rather than at the
+# global default ~/.local/share/pnpm/store). Always ignored — the store
+# is pnpm's cache, not source.
+.pnpm-store/
+
 # Turbo
 .turbo