[Task]: scaffold.mjs is non-atomic, has no re-run guard, and accepts invalid project names

[tonytino]

Goal

scripts/scaffold.mjs mutates many files (package.json, README, CHANGELOG, AGENTS.md), deletes files, then deletes itself — with no error handling, no rollback, and no guard against re-running on an already-scaffolded repo. Certain inputs also produce an invalid package.json name. Make scaffolding safe to run and safe to fail.

Acceptance Criteria

• On startup, if the repo is already scaffolded (e.g. .construct sentinel exists), the script refuses to run with a clear message
• The mutation phase is wrapped so a mid-run failure reports clearly and does not leave a silently half-customized repo (rollback or at minimum a clear "partial state" error)
• slugify collapses repeated/leading/trailing hyphens and falls back to a default when the result is empty or otherwise invalid as an npm package name; the project name is validated/escaped before being written into JSON/markdown
• delete pkg.scripts.scaffold is used rather than relying on JSON.stringify dropping an undefined value
• Final "next steps" output matches the generated README (.env vs .env.local consistency — see docs accuracy issue)

Context / Files

• scripts/scaffold.mjs — whole mutation flow (~lines 76-230); slugify ~43-48; .construct write ~135-142 (never read back); pkg.scripts.scaffold = undefined ~84; next-steps mismatch (line 109 README vs line 230 output)
• Related: Scaffold script uses fragile piped stdin with two readline instances #19 (sequential readline fragility), and the docs-accuracy issue for .env naming

[tonytino]

Completed in #38 (merged). The PR body wrote "Closes #23 and #24", which only auto-closes #23 — GitHub needs the keyword before each number — so closing manually.

All acceptance criteria landed on main:

• Re-run guard: aborts if .construct already exists (scripts/scaffold.mjs).
• slugify collapses non-alphanumeric runs + trims hyphens, with a my-project fallback for names that slugify to nothing.
• Scaffold script removed via Object.fromEntries/filter (clean key removal; also avoids biome's noDelete rule).
• Partial-state failure handler prints a clear message + git checkout . && git clean -fd recovery hint instead of a raw stack trace.
• Next-steps .env consistency was already handled in [Task]: Fix documentation & setup-instruction accuracy #26.