Add Promptkit debug capture for generated reports

docs/internal/cli.md

@@ -17,6 +17,10 @@ factory maps `promptkit` configuration to the Promptkit adapter, while tests can
 inject a factory without importing dependency types. Each `generate` request
 constructs one executor after configuration loads and passes it to the app.
 
+All four `generate` commands also accept `--llm-debug-dir PATH`. The CLI passes
+only this explicit request to the app; the app initializes the secure debug
+root before prompt inspection. `run` commands do not accept the flag.
+
 For inspection, it loads configuration, builds the appropriate app inspection
 request, and writes the returned value. Inspection is read-only; the inspected
 artifact types and user invocation remain owned by the [CLI reference](../cli.md)
@@ -29,7 +33,7 @@ carry report identity, status, relevant artifact paths, and notification
 summary data. Batch summaries carry aggregate counts, per-report outcomes, and
 the optional batch notification result. The translation deliberately excludes
 full module snapshots, prompt packages, raw generated text, Scriptorium output,
-and complete Distributor payloads.
+complete Distributor payloads, and prompt-debug content.
 
 When an action returns both a result and an error, the CLI writes the failed
 summary before returning that error. Parse, configuration-load, and other