fix: pre-landing review fixes for the Aside-first branch

Review army + adversarial passes (Claude and Codex) on the merged branch:

setup
- _prune_stale_generated scans the host dirs too (the generator already
  removed the render before setup ran, so the host branch was dead), skips
  symlinks in the render tree (rm -rf on a slash-terminated link empties its
  target), removes a host symlink only when it resolves into gstack, cleans a
  bannered real dir through _cleanup_weak_dir, recognizes frontmatter-renamed
  skills, and logs through log. The always-run codex render passes every host
  dir that may link to it.
- NEEDS_BUILD checks all three binaries (with $_EXE) and lib/ sources; the
  browser hint and the bootstrap summary honor GSTACK_SKIP_ASIDE, treat a
  requested skip as a request, and derive one skill list.

lib/aside-render.ts + bin/gstack-render.ts
- The loopback server carries a per-render secret path, checks containment on
  the real path (symlink escapes are 403), and rejects malformed encoding.
- Inline eval results are one base64 line, so page text cannot forge
  ASIDE_DIR= or the sentinel; the last ASIDE_DIR wins.
- runProc escalates SIGTERM to SIGKILL, bounds every wait, and clears every
  timer (an uncleared one kept gstack-render alive after printing OK).
- renderTmpDir refuses a shared /tmp name owned by someone else; the work dir
  and server are created inside try; goto's budget follows the render budget.
- probeAside classifies a present-but-failing CLI as ASIDE_NOT_RUNNING like
  the skills' bash probe; render() retries on gstack's own browser when Aside
  could not start or its private CDP bridge is gone (never on a page error
  or a timeout of a running script); the CLI reports the engine that actually
  rendered, exits 0 on --help, rejects non-numeric flags, documents
  --wait-timeout, fences EVAL/PAGE_ERRORS as untrusted content, and names the
  daemon's cookie-import JS lock remedy.
- The browse path passes --scale only when asked (a scale change rebuilds
  the daemon context) and restores the viewport after a sized screenshot.

resolvers / templates
- The bash probe honors GSTACK_SKIP_ASIDE and has a perl deadline on stock
  macOS; .local is no longer LOCAL (mDNS); same-origin filters compare parsed
  origins; link status is HEAD-checked only on LOCAL targets; every
  aside exec goes through the receipted _aside_exec prelude
  ({{ASIDE_EXEC_PRELUDE}}), including nine template blocks that called it
  bare; the design sketch and diagram staging use private directories.
- The generator prunes only bannered renders and never a host whose
  generation failed.

Docs, stale comments and dead code cleaned; goldens re-rendered; tests
updated and added for every behavior above.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

diagram/SKILL.md

@@ -195,9 +195,11 @@ Decide the output directory: `./diagrams/` when the cwd is a git repo
 
 `gstack-render` serves the bundle's directory on 127.0.0.1 for each render
 (Aside refuses `file://`, and both engines get the same origin). Stage the bundle under
-gstack's own render staging directory, `/tmp/gstack-render/`, content-addressed
-by bundle sha: the served directory holds nothing but gstack bundles, and
-concurrent sessions or mixed gstack versions never clobber each other.
+gstack's own render staging directory, `${TMPDIR:-/tmp}/gstack-render` (yours
+alone: if that name is a symlink or another user's directory, a private
+`mktemp -d` is used instead), content-addressed by bundle sha: the served
+directory holds nothing but gstack bundles, and concurrent sessions or mixed
+gstack versions never clobber each other.
 
 ```bash
 BUNDLE=""
@@ -206,9 +208,10 @@ for c in "$HOME/.claude/skills/gstack/lib/diagram-render/dist/diagram-render.htm
   [ -f "$c" ] && BUNDLE="$c" && break
 done
 [ -z "$BUNDLE" ] && echo "BUNDLE_MISSING — run: cd ~/.claude/skills/gstack && bun run build:diagram-render" && exit 1
-mkdir -p /tmp/gstack-render
+RD="${TMPDIR:-/tmp}/gstack-render"
+if [ -e "$RD" ] && { [ -L "$RD" ] || [ ! -O "$RD" ]; }; then RD=$(mktemp -d "${TMPDIR:-/tmp}/gstack-render.XXXXXX"); else mkdir -p -m 700 "$RD"; fi
 SHA=$(shasum -a 256 "$BUNDLE" | cut -c1-16)
-STAGED="/tmp/gstack-render/gstack-diagram-render-$SHA.html"
+STAGED="$RD/gstack-diagram-render-$SHA.html"
 [ -f "$STAGED" ] && shasum -a 256 "$STAGED" | grep -q "^$SHA" || { cp "$BUNDLE" "$STAGED.$$" && mv "$STAGED.$$" "$STAGED"; }
 echo "STAGED: $STAGED"
 ```

diagram/SKILL.md.tmpl

@@ -65,9 +65,11 @@ Decide the output directory: `./diagrams/` when the cwd is a git repo
 
 `gstack-render` serves the bundle's directory on 127.0.0.1 for each render
 (Aside refuses `file://`, and both engines get the same origin). Stage the bundle under
-gstack's own render staging directory, `/tmp/gstack-render/`, content-addressed
-by bundle sha: the served directory holds nothing but gstack bundles, and
-concurrent sessions or mixed gstack versions never clobber each other.
+gstack's own render staging directory, `${TMPDIR:-/tmp}/gstack-render` (yours
+alone: if that name is a symlink or another user's directory, a private
+`mktemp -d` is used instead), content-addressed by bundle sha: the served
+directory holds nothing but gstack bundles, and concurrent sessions or mixed
+gstack versions never clobber each other.
 
 ```bash
 BUNDLE=""
@@ -76,9 +78,10 @@ for c in "$HOME/.claude/skills/gstack/lib/diagram-render/dist/diagram-render.htm
   [ -f "$c" ] && BUNDLE="$c" && break
 done
 [ -z "$BUNDLE" ] && echo "BUNDLE_MISSING — run: cd ~/.claude/skills/gstack && bun run build:diagram-render" && exit 1
-mkdir -p /tmp/gstack-render
+RD="${TMPDIR:-/tmp}/gstack-render"
+if [ -e "$RD" ] && { [ -L "$RD" ] || [ ! -O "$RD" ]; }; then RD=$(mktemp -d "${TMPDIR:-/tmp}/gstack-render.XXXXXX"); else mkdir -p -m 700 "$RD"; fi
 SHA=$(shasum -a 256 "$BUNDLE" | cut -c1-16)
-STAGED="/tmp/gstack-render/gstack-diagram-render-$SHA.html"
+STAGED="$RD/gstack-diagram-render-$SHA.html"
 [ -f "$STAGED" ] && shasum -a 256 "$STAGED" | grep -q "^$SHA" || { cp "$BUNDLE" "$STAGED.$$" && mv "$STAGED.$$" "$STAGED"; }
 echo "STAGED: $STAGED"
 ```