iac-planlisted

# iac-plan Wraps `bin/iac-plan.sh`. It detects the repo's `iac.tool`, dispatches to the per-tool adapter (`bin/iac-plan/<tool>.sh`), captures whatever machine-readable plan the tool offers, and emits a normalized **IacPlan** JSON on stdout (schema: `schemas/iac-plan.schema.json`). This skill is READ-ONLY: it previews, it never applies. To apply, hand off to `/nyann:apply`. ## 1. Confirm this is an IaC repo before running iac-plan is only meaningful on an infrastructure repo. Before invoking, satisfy yourself there's an infra signal — a tool name in the request (terraform / tofu / cdk / pulumi / helm / kubectl / kustomize / ansible), an explicit "infra"/"deploy" intent, OR a detected `iac.tool` in the stack descriptor (`bin/detect-stack.sh --path <cwd>` → `.iac.tool`). If there's no infra signal, this is the wrong skill — see DISAMBIGUATION in the frontmatter and do not run. ## 2. Scope: whole target or a single unit By default iac-plan previews the whole target root (`unit:"."`). When the user names a specific module/stack/chart/overlay/playbook (or the repo is a monorepo with multiple units), scope it with `--unit`: ``` bin/iac-plan.sh --target <cwd> [--unit <repo-rel-path>] ``` `--unit` is a **repo-relative** path resolved under the target with a traversal guard — a path that escapes the target is refused (see step 4). Omit it to plan the root. ## 3. Invoke ``` bin/iac-plan.sh --target <cwd> [--unit <repo-rel-path>] ``` The script emits one IacPlan JSON object on