Codex marketplace package drops executable bits on SDD helper scripts

Summary

Superpowers 6.2.0 installed through the Codex marketplace cache arrived with these helper files non-executable (observed mode 0644):

• skills/subagent-driven-development/scripts/sdd-workspace
• skills/subagent-driven-development/scripts/task-brief
• skills/subagent-driven-development/scripts/review-package

Direct invocation fails with Permission denied. Invoking only task-brief or review-package through Bash does not fully recover the default-output path because both scripts directly execute their sibling sdd-workspace.

Expected behavior

The upstream Git tree records all three files as 100755. Please preserve those executable modes in the Codex marketplace packaging/install path.

Downstream mitigation

Our framework now treats this only as a packaging workaround: it validates the allowlisted helper set, copies helper content to private staging, invokes it explicitly through /bin/bash, and never changes the generated plugin cache. This keeps the helpers usable but is not a substitute for preserving upstream modes.

No credentials or repository source are involved in this reproduction.