Merge origin/main (v1.60.1.0) into garrytan/gstack-fix-wave

Semantic reconciliation with the parallel time-attack wave (#2264):
- careful: adopt main's anchored full-command whitelist (stricter — also
  catches comment-hiding), re-apply this wave's two hardenings on top
  (capital -[rR] in the flag cluster; exclude `(` and backtick from safe
  targets so $()/backtick substitution cannot ride the whitelist). Union
  of both waves' test batteries passes (main's test.each incl. comment
  case + this wave's substitution/capital-R/FP-pin cases).
- one-way-doors: main landed the singular noun unification (a2a447a1);
  keep this wave's superset (plural s? + --summary-stdin runtime wiring).
- gbrain-local-status: union of states — main's engine-locked (#2194,
  exit 124 PGLite lock) + this wave's thin-client (#2051). --is-ok keeps
  main's intent (engine-locked = STOP) and this wave's (thin-client =
  usable). Test harness unions both fake behaviors.
- sync-gbrain/setup-gbrain tmpls: both Step 1.5 branches kept; generated
  SKILL.md resolved via bun run gen:skill-docs (never hand-edited).
- VERSION/package.json -> 1.61.0.0 per bin/gstack-next-version (main took
  1.60.1.0; PR #2470 claims 1.60.2.0). CHANGELOG: wave entry renumbered
  1.61.0.0 on top of main's 1.60.1.0; careful/#2024 bullets updated to
  describe the delta vs current main. TODOS: union.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

setup-gbrain/SKILL.md

@@ -820,11 +820,11 @@ Capture the JSON output. It contains: `gbrain_on_path`, `gbrain_version`,
 `gbrain_config_exists`, `gbrain_engine`, `gbrain_doctor_ok`, `gbrain_mcp_mode`,
 `gstack_brain_sync_mode`, `gstack_brain_git`, `gstack_artifacts_remote`, and
 the v1.34.0.0+ `gbrain_local_status` field (one of: `ok`, `no-cli`,
-`missing-config`, `broken-config`, `broken-db`, `timeout`, `thin-client`).
-Treat `timeout` like `ok` (slow-but-healthy engine, #1964) — it never triggers
-Step 1.5 remediation. Treat `thin-client` like `ok` too (#2051): the machine
-is a thin client of a remote-HTTP MCP brain, no local engine by design —
-brain-aware blocks render, and the detect JSON carries
+`missing-config`, `broken-config`, `broken-db`, `engine-locked`, `timeout`,
+`thin-client`). Treat `timeout` like `ok` (slow-but-healthy engine, #1964) — it
+never triggers Step 1.5 remediation. Treat `thin-client` like `ok` too (#2051):
+the machine is a thin client of a remote-HTTP MCP brain, no local engine by
+design — brain-aware blocks render, and the detect JSON carries
 `gbrain_thin_client: {probed: false}` (config verified; remote reachability
 is checked at use time, where gbrain calls degrade gracefully).
 

setup-gbrain/SKILL.md.tmpl

@@ -66,11 +66,11 @@ Capture the JSON output. It contains: `gbrain_on_path`, `gbrain_version`,
 `gbrain_config_exists`, `gbrain_engine`, `gbrain_doctor_ok`, `gbrain_mcp_mode`,
 `gstack_brain_sync_mode`, `gstack_brain_git`, `gstack_artifacts_remote`, and
 the v1.34.0.0+ `gbrain_local_status` field (one of: `ok`, `no-cli`,
-`missing-config`, `broken-config`, `broken-db`, `timeout`, `thin-client`).
-Treat `timeout` like `ok` (slow-but-healthy engine, #1964) — it never triggers
-Step 1.5 remediation. Treat `thin-client` like `ok` too (#2051): the machine
-is a thin client of a remote-HTTP MCP brain, no local engine by design —
-brain-aware blocks render, and the detect JSON carries
+`missing-config`, `broken-config`, `broken-db`, `engine-locked`, `timeout`,
+`thin-client`). Treat `timeout` like `ok` (slow-but-healthy engine, #1964) — it
+never triggers Step 1.5 remediation. Treat `thin-client` like `ok` too (#2051):
+the machine is a thin client of a remote-HTTP MCP brain, no local engine by
+design — brain-aware blocks render, and the detect JSON carries
 `gbrain_thin_client: {probed: false}` (config verified; remote reachability
 is checked at use time, where gbrain calls degrade gracefully).