feat(app-control): add /app-control:map create with config, driver CLI and safety sections #9581

Slice A2 of #9507, from poteto's draft (comment) amended to the owner's decisions.

Problem

Nothing generates a control-<app> skill. /testing:map-features writes only testing's map.

Fix

• New plugins/app-control/skills/map/SKILL.md. A bare run proposes; it accepts create and --unattended.
• create: discovery over every feat(app-control): discover-and-interview setup that generates and maintains a control skill #9507 Discover row, then residue questions through /planning:interview when installed (inline otherwise), generate, prove through /app-control:drive, check the evidence survived and no process is left, and state what a stand-in did that the target will not.
• Contract sections added to plugins/app-control/reference/control-skill.md: config layering (config/defaults.json < config/local.json < env < flags, reporting each value's layer; fields: environment, timeouts, credential variable names, safety floors, pluginDir), the driver CLI written through /developer-experience:build-cli when installed (a documented script otherwise), and safety floors (recipient allowlist, one sign-in attempt per account per run with a failure stopping the run, production marked production: true and read-only by default, unattended writes off).
• The control-skill pointer goes only to the repository's source-of-truth instruction surface; a shim's import target wins.
• Port the 16 map-features cases and feature-map-writer-refuses-unsafe-location. Add discovery-before-questions, unlisted-recipient-stops-at-form, failed-sign-in-stops-run, unattended-safety-question-stops, prove-leaves-evidence-no-orphan, config-reports-source-layer.
• README skills row and pstack attribution; docs/upstream/cursor-pstack.md rows; catalog and cheat-sheet rows. Fragment: app-control minor.

Done when

• test -f plugins/app-control/skills/map/SKILL.md exits 0 and grep -E 'argument-hint:.*create.*--unattended' plugins/app-control/skills/map/SKILL.md matches.
• /skill-quality:check map reports PASS; /evals:validate passes on the map suite.
• Ported cases are non-inferior to map-features (run concurrently); the six new cases pass.

Blocked by: A1.