fix: adversarial review — GitLab gate, shell safety, MR prefix preservation

Three fixes from adversarial review:
1. land-and-deploy: add GitLab gate after Step 0 — prevents detection/
   execution mismatch where agent detects GitLab but all subsequent
   steps are GitHub-only
2. document-release: use heredoc for glab mr update body to avoid shell
   metacharacter mangling ($, backticks, !) in MR descriptions
3. retro: preserve original #/! prefix in PR/MR number extraction —
   GitLab !42 stays as !42, not incorrectly converted to #42

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

document-release/SKILL.md

@@ -573,8 +573,12 @@ gh pr edit --body-file /tmp/gstack-pr-body-$$.md
 ```
 
 **If GitLab:**
+Read the contents of `/tmp/gstack-pr-body-$$.md` using the Read tool, then pass it to `glab mr update` using a heredoc to avoid shell metacharacter issues:
 ```bash
-glab mr update -d "$(cat /tmp/gstack-pr-body-$$.md)"
+glab mr update -d "$(cat <<'MRBODY'
+<paste the file contents here>
+MRBODY
+)"
 ```
 
 5. Clean up the tempfile:

document-release/SKILL.md.tmpl

@@ -320,8 +320,12 @@ gh pr edit --body-file /tmp/gstack-pr-body-$$.md
 ```
 
 **If GitLab:**
+Read the contents of `/tmp/gstack-pr-body-$$.md` using the Read tool, then pass it to `glab mr update` using a heredoc to avoid shell metacharacter issues:
 ```bash
-glab mr update -d "$(cat /tmp/gstack-pr-body-$$.md)"
+glab mr update -d "$(cat <<'MRBODY'
+<paste the file contents here>
+MRBODY
+)"
 ```
 
 5. Clean up the tempfile:

land-and-deploy/SKILL.md

@@ -309,6 +309,8 @@ branch name wherever the instructions say "the base branch" or `<default>`.
 
 ---
 
+**If the platform detected above is GitLab or unknown:** STOP with: "GitLab support for /land-and-deploy is not yet implemented. Run `/ship` to create the MR, then merge manually via the GitLab web UI." Do not proceed.
+
 # /land-and-deploy — Merge, Deploy, Verify
 
 You are a **Release Engineer** who has deployed to production thousands of times. You know the two worst feelings in software: the merge that breaks prod, and the merge that sits in queue for 45 minutes while you stare at the screen. Your job is to handle both gracefully — merge efficiently, wait intelligently, verify thoroughly, and give the user a clear verdict.

land-and-deploy/SKILL.md.tmpl

@@ -21,6 +21,8 @@ allowed-tools:
 
 {{BASE_BRANCH_DETECT}}
 
+**If the platform detected above is GitLab or unknown:** STOP with: "GitLab support for /land-and-deploy is not yet implemented. Run `/ship` to create the MR, then merge manually via the GitLab web UI." Do not proceed.
+
 # /land-and-deploy — Merge, Deploy, Verify
 
 You are a **Release Engineer** who has deployed to production thousands of times. You know the two worst feelings in software: the merge that breaks prod, and the merge that sits in queue for 45 minutes while you stare at the screen. Your job is to handle both gracefully — merge efficiently, wait intelligently, verify thoroughly, and give the user a clear verdict.

retro/SKILL.md

@@ -341,7 +341,7 @@ git log origin/<default> --since="<window>" --format="%at|%aN|%ai|%s" | sort -n
 git log origin/<default> --since="<window>" --format="" --name-only | grep -v '^$' | sort | uniq -c | sort -rn
 
 # 5. PR/MR numbers from commit messages (GitHub #NNN, GitLab !NNN)
-git log origin/<default> --since="<window>" --format="%s" | grep -oE '[#!][0-9]+' | sed 's/^[#!]//' | sort -n | uniq | sed 's/^/#/'
+git log origin/<default> --since="<window>" --format="%s" | grep -oE '[#!][0-9]+' | sort -t'#' -k1 | uniq
 
 # 6. Per-author file hotspots (who touches what)
 git log origin/<default> --since="<window>" --format="AUTHOR:%aN" --name-only
@@ -813,7 +813,7 @@ git -C <path> log origin/$DEFAULT --since="<start_date>T00:00:00" --format="%at|
 git -C <path> shortlog origin/$DEFAULT --since="<start_date>T00:00:00" -sn --no-merges
 
 # PR/MR numbers from commit messages (GitHub #NNN, GitLab !NNN)
-git -C <path> log origin/$DEFAULT --since="<start_date>T00:00:00" --format="%s" | grep -oE '[#!][0-9]+' | sed 's/^[#!]//' | sort -n | uniq | sed 's/^/#/'
+git -C <path> log origin/$DEFAULT --since="<start_date>T00:00:00" --format="%s" | grep -oE '[#!][0-9]+' | sort -t'#' -k1 | uniq
 ```
 
 For repos that fail (deleted paths, network errors): skip and note "N repos could not be reached."

retro/SKILL.md.tmpl

@@ -88,7 +88,7 @@ git log origin/<default> --since="<window>" --format="%at|%aN|%ai|%s" | sort -n
 git log origin/<default> --since="<window>" --format="" --name-only | grep -v '^$' | sort | uniq -c | sort -rn
 
 # 5. PR/MR numbers from commit messages (GitHub #NNN, GitLab !NNN)
-git log origin/<default> --since="<window>" --format="%s" | grep -oE '[#!][0-9]+' | sed 's/^[#!]//' | sort -n | uniq | sed 's/^/#/'
+git log origin/<default> --since="<window>" --format="%s" | grep -oE '[#!][0-9]+' | sort -t'#' -k1 | uniq
 
 # 6. Per-author file hotspots (who touches what)
 git log origin/<default> --since="<window>" --format="AUTHOR:%aN" --name-only
@@ -560,7 +560,7 @@ git -C <path> log origin/$DEFAULT --since="<start_date>T00:00:00" --format="%at|
 git -C <path> shortlog origin/$DEFAULT --since="<start_date>T00:00:00" -sn --no-merges
 
 # PR/MR numbers from commit messages (GitHub #NNN, GitLab !NNN)
-git -C <path> log origin/$DEFAULT --since="<start_date>T00:00:00" --format="%s" | grep -oE '[#!][0-9]+' | sed 's/^[#!]//' | sort -n | uniq | sed 's/^/#/'
+git -C <path> log origin/$DEFAULT --since="<start_date>T00:00:00" --format="%s" | grep -oE '[#!][0-9]+' | sort -t'#' -k1 | uniq
 ```
 
 For repos that fail (deleted paths, network errors): skip and note "N repos could not be reached."