Merge origin/main (v1.64.1.0) into garrytan/time-attack-fork-review

The code-smell wave refactored the tunnel start into the staged
startTunnel helper; the merge adopts that structure and threads this
branch's truthful consent strings through its consent parameter (the
receipt now names the isPairAgentEnabled gate at both call sites). The
eng-review PTY warmup takes both improvements: main's resolveClaudeBinary
fallback and this branch's resolveEvalModel kind. Resolver imports
union; carve budgets take the larger of both waves' measured values
(parity suite green on the merged tree); conflicted generated SKILL.md
files regenerated from resolved sources. VERSION stays 1.65.0.0 over
main's 1.64.1.0; CHANGELOG stacks 1.65.0.0 > 1.64.1.0 > 1.64.0.0.

spec/SKILL.md.tmpl

@@ -1,5 +1,6 @@
 ---
 name: spec
+preamble-tier: 3
 version: 0.1.0
 description: |
   Turn vague intent into a precise, executable spec in five phases. Files the issue,
@@ -288,8 +289,8 @@ contributor's "match template to content" rules.
 
 #### Phase 5 dispatch logic (plan-mode-aware default)
 
-Read `GSTACK_PLAN_MODE` from the environment (emitted by `{{PREAMBLE}}`'s
-preamble bash). Then:
+Read `GSTACK_PLAN_MODE` from the environment (emitted by the preamble bash at
+the top of this skill). Then:
 
 1. **`--file-only` or `--no-execute` flag present** → file-only path.
 2. **`--execute` flag present** → file + spawn path.