elevation: add x/elevate plugin; update mkfile and docs

Replace tools/elevate_superpowers with scripts/x/elevate — a single
self-contained plugin that bootstraps into a superpowers session and
runs the IPC. mkfile installs it to ~/.config/ollie/scripts/x/.
Update 08_tool-elevate.md to remove backend-specific language.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

mkfile

@@ -38,8 +38,7 @@ data:V:
 
 scripts:V:
 	echo === Installing scripts ===
-	mkdir -p $HOME/.config/ollie/scripts/s $HOME/.config/ollie/scripts/b $HOME/.config/ollie/scripts/u
-	chmod 755 $HOME/.config/ollie/scripts/u
+	mkdir -p $HOME/.config/ollie/scripts/s $HOME/.config/ollie/scripts/b $HOME/.config/ollie/scripts/u $HOME/.config/ollie/scripts/x
 	cp -f scripts/s/sh      $HOME/.config/ollie/scripts/s/sh
 	cp -f scripts/s/ls      $HOME/.config/ollie/scripts/s/ls
 	cp -f scripts/s/kill    $HOME/.config/ollie/scripts/s/kill
@@ -48,7 +47,8 @@ scripts:V:
 	cp -f scripts/b/sched   $HOME/.config/ollie/scripts/b/sched
 	cp -f scripts/b/cleanup $HOME/.config/ollie/scripts/b/cleanup
 	cp -f scripts/u/optimize $HOME/.config/ollie/scripts/u/optimize
-	chmod 755 $HOME/.config/ollie/scripts/u/optimize
+	cp -f scripts/x/elevate $HOME/.config/ollie/scripts/x/elevate
+	chmod 755 $HOME/.config/ollie/scripts/u/optimize $HOME/.config/ollie/scripts/x/elevate
 
 help:V:
 	echo 'Ollie monorepo build targets:'

prompts/08_tool-elevate.md

@@ -1,6 +1,6 @@
 # Elevation
 
-**Purpose**: run a bash command outside the sandbox with user approval, via the configured elevation backend (e.g. superpowers).
+**Purpose**: run a bash command outside the sandbox with user approval.
 
 **Trigger condition**: any time a task requires privileges unavailable inside the sandbox — installing packages, writing to protected paths, managing system services, etc.
 
@@ -11,7 +11,7 @@ execute_code: steps=[{code: "systemctl restart nginx", elevated: true}]
 ```
 
 **Constraints**:
-- `elevated: true` is a per-step flag — apply it only to steps that actually need it. Other steps in the same pipeline run normally inside the sandbox.
+- `elevated: true` is a per-step flag — apply it only to steps that actually need it; other steps in the same pipeline run normally inside the sandbox.
 - Only bash is supported for elevated steps.
-- The elevation backend must be available; if not, the step fails with "elevation not available". Do not assume elevation is always present.
-- Elevated steps block until the user approves or denies the request — this is expected behavior, not an error. Use elevation whenever the task requires it; the approval prompt is the user's opportunity to review and allow the action.
+- Elevation may not be available on all systems; if absent, the step fails with "elevation not available". Do not assume it is always present.
+- Elevated steps block until the user approves or denies the request — this is expected, not an error. Use elevation whenever the task requires it; the prompt is the user's opportunity to review the action.

scripts/x/elevate

@@ -1,10 +1,9 @@
 #!/usr/bin/env python3
-"""Run a command elevated via superpowerd IPC (buffered output).
+"""Elevation plugin: run a command outside the sandbox via superpowers.
 
-Usage: elevate_superpowers <command>
+Usage: elevate -- <cmd>
 
-Requires SUPERPOWERD_SESSION_TOKEN in environment (set by superpowers run-session).
-Exits with the elevated command's exit code.
+Replace this script to use a different elevation mechanism.
 """
 import json
 import os
@@ -23,24 +22,25 @@ def _socket_path():
 
 
 def main():
-    token = os.environ.get("SUPERPOWERD_SESSION_TOKEN")
-    if not token:
-        print("elevate_superpowers: SUPERPOWERD_SESSION_TOKEN not set", file=sys.stderr)
+    if "SUPERPOWERD_SESSION_TOKEN" not in os.environ:
+        os.execvp("superpowers", ["superpowers", "run-session", "--",
+                                   sys.executable, __file__] + sys.argv[1:])
+
+    # sys.argv: ['elevate', '--', '<cmd>']
+    if len(sys.argv) < 3:
+        print("usage: elevate -- <cmd>", file=sys.stderr)
         sys.exit(1)
 
-    if len(sys.argv) < 2:
-        print("usage: elevate_superpowers <command>", file=sys.stderr)
-        sys.exit(1)
-
-    cmd = sys.argv[1]
+    cmd = sys.argv[2]
     cwd = os.getcwd()
+    token = os.environ["SUPERPOWERD_SESSION_TOKEN"]
 
     sock_path = _socket_path()
     sock = socket.socket(socket.AF_UNIX, socket.SOCK_SEQPACKET)
     try:
         sock.connect(sock_path)
     except OSError as e:
-        print(f"elevate_superpowers: connect {sock_path}: {e}", file=sys.stderr)
+        print(f"elevate: connect {sock_path}: {e}", file=sys.stderr)
         sys.exit(1)
 
     req = json.dumps({
@@ -63,7 +63,7 @@ def main():
     rpc_err = resp.get("error")
     if rpc_err:
         msg = rpc_err.get("message", str(rpc_err)) if isinstance(rpc_err, dict) else str(rpc_err)
-        print(f"elevate_superpowers: {msg}", file=sys.stderr)
+        print(f"elevate: {msg}", file=sys.stderr)
         sys.exit(1)
 
     result = resp.get("result", {})