enhancement(orchestrator): standardize 'enumerate before fix' sweep template to prevent incomplete sibling propagation

## Summary

Several findings during the ftc-blue Phase 1d cycle traced back to **incomplete sweeps**: an agent was asked to perform a rename, refactor, or convention-fix across multiple files, completed the obvious targets, but missed sibling instances. The adversary then caught the missed siblings 2–3 passes later as new findings.

Examples:

- Pass-5 H-4 renamed `optional_artifacts_inspected_count` → canonical Array form in SM-ENDING-PATHS. Missed 5 sibling files (BC-13.13.003 + 4 holdouts). Caught pass-9 F-H4.
- Pass-6 H-2 renamed UX `OQ-002/003/005` → `UX-OQ-001/002/003`. Missed 3 siblings (OQ-001/004/006). Caught pass-9 F-H2.
- Pass-6 M-3 promoted INV-001/002 to DI-009/010 in ARCH-INDEX §5. Missed L2-INDEX side. Caught pass-7 H-7 (then regressed due to file rename and caught again pass-8 H-1).
- Pass-7 M-1 fixed BC-1.01.006 action count to 14. Missed cascade to NFR-012 reverse-anchor entries.

In every case, the agent did the work it was explicitly asked to do — the prompts simply didn't require systematic enumeration of all matches before fixing.

## Proposed change

Standardize a "sweep template" that the orchestrator uses whenever it dispatches a rename / refactor / convention-fix / namespace-migration task. The template requires the agent to:

1. **Enumerate**: First, run a `grep -rn` (or equivalent) for the old pattern across the entire spec corpus (or the documented scope). Report the total match count and per-file breakdown to the deliverable.
2. **Fix**: Apply the change to every match. No "I'll fix the obvious ones and leave the rest" — every match.
3. **Verify**: Re-run the same grep. Report exit-zero (zero matches remain) or list the surviving matches with justification (e.g., "matches in changelog sections were intentionally preserved as audit trail").

The template is built into:

- The orchestrator's prompt builder when it composes sweep dispatches.
- The agent's response checklist (the agent literally has a 3-step structure to follow).
- The deliverable schema (sweep tasks must include the enumeration + verification log).

## Applies to

- `agents/orchestrator/AGENTS.md` — sweep dispatch template
- All agents that take sweep tasks: product-owner, architect, spec-steward, story-writer
- New section in each agent's AGENTS.md: "When given a sweep task, you must enumerate, fix, and verify."

## Acceptance criteria

- [ ] AGENTS.md documents the sweep template with worked example
- [ ] Orchestrator's sweep dispatches embed the template explicitly in the prompt
- [ ] Agent deliverables include enumeration and verification logs
- [ ] Test case: synthetic 10-file rename task → agent enumerates all 10, fixes all 10, verifies 0 remain

## Found during

ftc-blue Phase 1d adversarial cycle (2026-06-23, vsdd-factory@1.0.0-rc.21). Cumulative: 4 high-severity findings (~12 missed siblings total) over 5 passes traceable to incomplete sweeps.

## Notes

This is one of the highest-impact rule changes — incomplete sweeps account for a large fraction of fresh-context novelty in subsequent adversarial passes.