Migrate @inquirer/prompts to v8 (requires @inquirer/core v11 + checkbox API changes)

[clay-good]

Summary

@inquirer/prompts is pinned at ^7.10.1. Upgrading to v8 is not a version bump — it needs a code migration across three files. Dependabot's attempt (#1450) failed every CI job and has been closed; this issue tracks doing it properly.

Why the automated bump can't work

1. checkbox's instructions option was removed

src/commands/config.ts:587 fails to compile under v8:

error TS2353: Object literal may only specify known properties,
and 'instructions' does not exist in type '{ message: string; prefix?: ... }'

The call site:

const selectedWorkflows = await checkbox<string>({
  message: 'Select workflows to make available:',
  instructions: 'Space to toggle, Enter to confirm',   // <-- removed in v8
  pageSize: ALL_WORKFLOWS.length,
  theme: { icon: { checked: '[x]', unchecked: '[ ]' } },
  choices: ALL_WORKFLOWS.map(formatWorkflowChoice),
});

Verified against the published package: @inquirer/prompts@8.5.2 bundles @inquirer/checkbox@5.2.1, whose types no longer expose instructions; customization now goes through theme?: PartialDeep<Theme<CheckboxTheme>>. Someone needs to decide whether to drop the hint text or re-express it via the theme — this is user-visible UX in openspec config.

2. The bigger issue: @inquirer/core must move too

@inquirer/prompts@8 → @inquirer/checkbox@5.2.1 → @inquirer/core@^11.2.1.

But package.json depends on @inquirer/core@^10.3.2 directly, because two files build custom prompts on its hooks API:

File	Imports from @inquirer/core
src/ui/welcome-screen.ts	createPrompt, isEnterKey, useKeypress
src/prompts/searchable-multi-select.ts	createPrompt, useState, useKeypress, useMemo, usePrefix, isEnterKey, isBackspaceKey, isUpKey, isDownKey

Bumping only @inquirer/prompts leaves two copies of @inquirer/core in the tree — custom prompts running v10 internals alongside bundled prompts on v11. That's a latent runtime hazard, not just a type error, and it wouldn't be caught by a green typecheck.

What the migration needs

• Bump @inquirer/prompts to ^8 and @inquirer/core to ^11 together
• Resolve the instructions removal in src/commands/config.ts
• Revalidate src/prompts/searchable-multi-select.ts against the core v11 hooks API (particularly usePrefix({ status }), whose signature is worth double-checking)
• Revalidate src/ui/welcome-screen.ts — the comment there notes that mixing a raw data listener between Inquirer prompts breaks arrow/space keys on Windows, so this needs a manual interactive test on Windows, not just a passing suite
• Manually exercise openspec init and openspec config interactively; the test suite does not cover prompt rendering
• Update the flake.nix pnpmDeps hash for the changed lockfile

Notes

• Not urgent: Audit is green on main, so there's no known vulnerability forcing v7 off.
• chore(deps): bump @inquirer/prompts from 7.10.1 to 8.5.2 #1450 was closed with @dependabot ignore this major version to stop it being recreated each cycle. That ignore must be reverted when this migration lands, otherwise future v8.x updates stay suppressed.