Merge origin/main (v1.64.0.0) into garrytan/time-attack-fork-review

Both waves fixed several of the same bugs; resolutions keep whichever
shape this branch's tests pin (#2018 jq bind, #1798 set-- pattern,
stop-ack, lock errors, polyfill windowsHide) and take main's richer
codex Step 2A (it absorbed the same mktemp fix). True unions: memory-
ingest keeps main's capability-probed --include-gitignored inside our
GIT_CEILING defense; setup wraps main's Playwright platform override in
our stale-healing install lock; package.json takes main's diff@^9 and
the combined test glob (design/test + ios-qa/daemon/test, 30s timeout).
Generated SKILL.md files regenerated from resolved templates, never
hand-picked. Ship goldens refreshed; parity/carve budgets re-measured
for the summed preamble growth of both waves (itemized per entry).

pair-agent/SKILL.md.tmpl

@@ -175,23 +175,34 @@ Then tell the user:
 "Copy the block above and paste it into your other agent's chat. The setup key
 expires in 5 minutes."
 
-**If ngrok is installed but NOT authed:** Walk the user through authentication:
+**If ngrok is installed but NOT authed:** Walk the user through authentication.
+
+SECURITY: the ngrok authtoken must NEVER pass through this chat, a Bash tool
+call, or shell history — a token pasted here lands in the transcript (and
+anything the transcript syncs to). The user runs the auth command in their
+OWN terminal; you only verify the result.
 
 Tell the user:
-"ngrok is installed but not logged in. Let's fix that:
+"ngrok is installed but not logged in. Let's fix that — in your own terminal
+(not here; the token should never enter this chat):
 
 1. Go to https://dashboard.ngrok.com/get-started/your-authtoken
 2. Copy your auth token
-3. Come back here and I'll run the auth command for you."
+3. In YOUR terminal, run: ngrok config add-authtoken <paste your token>
+4. Tell me 'done' when finished."
 
-STOP here and wait for the user to provide their auth token.
+STOP here and wait for the user to say they've run it. Do NOT accept a pasted
+token; if the user pastes one anyway, tell them to rotate it at
+https://dashboard.ngrok.com (it's now in the transcript) and re-auth in their
+terminal with the new one.
 
-When they provide it, run:
+When they say done, verify without touching the token:
 ```bash
-ngrok config add-authtoken THEIR_TOKEN
+ngrok config check 2>/dev/null && echo "NGROK_AUTHED" || echo "NGROK_NOT_AUTHED"
 ```
 
-Then retry `$B pair-agent --client TARGET_HOST`.
+If `NGROK_AUTHED`: retry `$B pair-agent --client TARGET_HOST`.
+If still `NGROK_NOT_AUTHED`: ask them to re-run the command in their terminal.
 
 **If ngrok is NOT installed:** Walk the user through installation: