v1.35.0.0 feat: add /document-generate skill + enhance /document-release with Diataxis coverage map (#1477)

* feat(document-release): add Diataxis coverage map, diagram drift detection, and docs debt tracking

Inspired by @doodlestein's documentation-website skill. Three key ideas incorporated:

1. Step 1.5: Coverage Map (Blast-Radius Analysis) — before editing any docs,
   scan the diff for new public surface and assess documentation coverage across
   Diataxis quadrants (reference/how-to/tutorial/explanation). Flags gaps without
   auto-generating content.

2. Architecture diagram drift detection — extracts entity names from ASCII/Mermaid
   diagrams and cross-references against the diff to catch stale diagrams.

3. Enhanced CHANGELOG sell test — Diataxis rubric scoring (0-3) replaces the
   subjective 'would a user want this?' check.

4. Documentation Debt section in PR body — surfaces coverage gaps and diagram
   drift as actionable items for future work.

All changes are audit-only: the skill flags what's missing, never auto-generates
missing documentation pages. Stays in its lane as a post-ship updater.

Co-Authored-By: Hermes Agent <agent@nousresearch.com>

* feat(document-generate): add Diataxis documentation generation skill

New /document-generate skill, the companion to /document-release. While
/document-release audits and fixes existing docs post-ship, /document-generate
writes missing documentation from scratch using the Diataxis framework.

Inspired by doodlestein documentation-website-for-software-project skill.

Co-Authored-By: Hermes Agent <agent@nousresearch.com>

* chore(docs): regenerate gstack/llms.txt with /document-generate entry

CI's check-freshness step ran gen:skill-docs and found llms.txt stale —
the index wasn't regenerated when /document-generate was added in the
preceding commit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(docs): regen document-generate/SKILL.md after merging main

Main brought in the Non-ASCII characters directive in the AskUserQuestion
Format resolver (scripts/resolvers/preamble/generate-ask-user-format.ts).
Regenerating document-generate/SKILL.md propagates the new section into
the generated output. check-freshness should now pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(CLAUDE.md): add workflow for fork PRs from garrytan-agents

Fork PRs from non-collaborators don't get base-repo secrets passed to
their CI workflows, so eval/E2E jobs fail with empty-env auth. New
section: when checking out a PR from garrytan-agents, push the branch
to garrytan/gstack and re-target the PR from there.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs: sync project docs for v1.35.0.0 + bump VERSION

- README.md: add /document-generate to skills table (Technical Writer
  category) + install-command skill lists
- CLAUDE.md: add document-generate/ to project structure tree
- SKILL.md.tmpl + regenerated SKILL.md: add /document-generate routing
  line ("write docs from scratch")
- VERSION: 1.34.0.0 → 1.35.0.0 (MINOR: new skill + enhancement)

CHANGELOG entry deferred to /ship.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: bump version and changelog (v1.35.0.0)

CHANGELOG entry for the document-generate skill + document-release
Diataxis enhancements. package.json synced to VERSION (drift repair
after merging main which had bumped pkg to 1.34.2.0).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs: generate /document-generate Diataxis docs (tutorial + how-to + explanation)

Fills the documentation debt items flagged by /document-release in PR #1477:
critical-gap tutorial coverage and common-gap explanation coverage for the
new /document-generate skill.

Quadrants: tutorial, how-to, explanation (reference already covered by
document-generate/SKILL.md).

- docs/tutorial-document-generate.md (1009 words): newcomer 90-second flow
- docs/howto-document-a-shipped-feature.md (770 words): post-ship audit + fill workflow
- docs/explanation-diataxis-in-gstack.md (1106 words): why Diataxis, trade-offs, alternatives
- README.md: links the three docs from the /document-generate skills-table row

All cross-links verified — every Related section points at an existing file.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Hermes Agent <agent@nousresearch.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -122,7 +122,8 @@ gstack/
 ├── investigate/     # /investigate skill (systematic root-cause debugging)
 ├── retro/           # Retrospective skill (includes /retro global cross-project mode)
 ├── bin/             # CLI utilities (gstack-repo-mode, gstack-slug, gstack-config, etc.)
-├── document-release/ # /document-release skill (post-ship doc updates)
+├── document-release/ # /document-release skill (post-ship doc updates + Diataxis coverage map)
+├── document-generate/ # /document-generate skill (Diataxis doc generator: tutorial/how-to/reference/explanation)
 ├── cso/             # /cso skill (OWASP Top 10 + STRIDE security audit)
 ├── design-consultation/ # /design-consultation skill (design system from scratch)
 ├── design-shotgun/  # /design-shotgun skill (visual design exploration)
@@ -452,6 +453,36 @@ Even if the agent strongly believes a change improves the project, these three
 categories require explicit user approval via AskUserQuestion. No exceptions.
 No auto-merging. No "I'll just clean this up."
 
+## Checking out PRs from garrytan-agents
+
+When the user says "check out <PR link>" and the PR is from `garrytan-agents/gstack`
+(or any other fork that is NOT a collaborator on `garrytan/gstack`), do NOT just
+`gh pr checkout`. Fork PRs don't receive base-repo secrets (`ANTHROPIC_API_KEY`,
+`OPENAI_API_KEY`, etc.), so the eval/E2E CI jobs fail with empty-env auth errors
+regardless of what's set on the base repo.
+
+**Workflow:** push the branch to `garrytan/gstack` (the base repo) and re-target
+the PR from there.
+
+Concretely, after `gh pr checkout <N>`:
+
+1. Note the original PR number and head branch name.
+2. Push the same branch to the base repo: `git push origin HEAD:<branch-name>`
+   (origin = `garrytan/gstack`, since the worktree is set up with that remote).
+3. Close the fork PR (`gh pr close <N> --comment "moving to base-repo branch for secret access"`).
+4. Open a new PR from the base-repo branch: `gh pr create --base main --head <branch-name>`.
+5. New PR's workflows will get secrets automatically.
+
+Why not fix it on the fork side? `garrytan-agents` isn't a collaborator on
+`garrytan/gstack`. Adding it as a collaborator (option A) or flipping the
+repo-wide "send secrets to fork PRs" toggle (option B) would let secrets reach
+fork PRs from anyone — broader blast radius than just moving this one branch.
+Option C (this section) keeps secret-distribution scope tight.
+
+If the user asks you to skip the move (e.g., "just leave it as a fork PR"),
+respect that — eval CI will fail with empty-env auth, but check-freshness,
+workflow-lint, and windows-tests will still pass on the fork PR.
+
 ## CHANGELOG + VERSION style
 
 **Versioning invariant (workspace-aware ship).** VERSION is a monotonic ordered