Merge remote-tracking branch 'origin/main' into garrytan/retention-cohorts

# Conflicts:
#	CHANGELOG.md
#	VERSION
#	package.json

setup

@@ -1512,3 +1512,20 @@ fi
 if [ "$NO_TEAM_MODE" -eq 1 ] && [ -x "$SETTINGS_HOOK" ]; then
   "$SETTINGS_HOOK" remove-source --source plan-tune-cathedral 2>/dev/null || true
 fi
+
+# ─── Redact pre-push guard hint (#1946) ──────────────────────────────────────
+# The credential pre-push hook is per-REPO state — setup runs in the gstack
+# checkout, the wrong repo to install it into. /ship offers the install once
+# at the moment of relevance (first push) and silently installs in any repo
+# where redact_prepush_hook=true. This hint is setup's whole involvement.
+# Hint only when UNSET — an explicit "false" is a recorded decline and must
+# not be re-nagged on every setup run (adversarial review finding 11).
+# `gstack-config get` defaults absent keys to "false", which is
+# indistinguishable from a decline — test key presence in the config file.
+_GSTACK_CFG_FILE="${GSTACK_HOME:-$HOME/.gstack}/config.yaml"
+if ! grep -q '^redact_prepush_hook:' "$_GSTACK_CFG_FILE" 2>/dev/null; then
+  log ""
+  log "Tip: gstack can block pushes containing credentials (per-repo git hook)."
+  log "     Enable once: gstack-config set redact_prepush_hook true — /ship"
+  log "     installs the hook automatically in every repo you ship from."
+fi