fix: make the setup composites rerun-safe (codex diff-review hardenings)

restore-deps: 'cp -r SRC node_modules' with an existing node_modules NESTS
the copy and leaves stale deps active — rm first. register-gstack-skills:
'ln -snf' hard-errors under set -eu when a REAL directory occupies the
gstack slot — clear a non-symlink leftover first. CI workspaces are fresh
today; a reusable composite must survive dirty reruns.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/actions/register-gstack-skills/action.yml

@@ -37,6 +37,13 @@ runs:
         # The gstack root stays a symlink — the preamble's runtime bash resolves
         # ~/.claude/skills/gstack/bin/* and ~/.claude/skills/gstack/<skill>/sections/*
         # through it, and bash follows cross-mount symlinks fine.
+        # `ln -snf` replaces a stale SYMLINK but hard-errors on a REAL
+        # directory under set -eu — clear a real-dir leftover first so the
+        # composite is rerun-safe (codex diff review). CI HOMEs are fresh;
+        # this only fires on a dirty rerun.
+        if [ -d "$SKILLS_DIR/gstack" ] && [ ! -L "$SKILLS_DIR/gstack" ]; then
+          rm -rf "${SKILLS_DIR:?}/gstack"
+        fi
         ln -snf "$REPO" "$SKILLS_DIR/gstack"
         for s in $SKILLS; do
           rm -rf "${SKILLS_DIR:?}/$s"

.github/actions/restore-deps/action.yml

@@ -13,6 +13,11 @@ runs:
     - shell: bash
       run: |
         if [ -d /opt/node_modules_cache ] && diff -q /opt/node_modules_cache/.bun.lock bun.lock >/dev/null 2>&1; then
+          # rm first: `cp -r SRC node_modules` with an existing node_modules
+          # NESTS the copy (node_modules/node_modules_cache) and leaves stale
+          # deps active. CI workspaces are fresh today, but a reusable
+          # composite must survive a rerun/dirty workspace (codex diff review).
+          rm -rf node_modules
           cp -r /opt/node_modules_cache node_modules
         else
           bun install