Merge origin/main into garrytan/pr-wave-1

Resolve conflicts:
- VERSION: main bumped to 0.10.0.0, wave 1 bumps to 0.10.1.0
- CHANGELOG: keep both entries (0.10.1.0 wave 1 + 0.10.0.0 autoplan)
- test/skill-validation.test.ts: auto-resolved

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -1,6 +1,6 @@
 # Changelog
 
-## [0.9.10.0] - 2026-03-22 — Community Security Wave
+## [0.10.1.0] - 2026-03-22 — Community Security Wave
 
 ### Added
 
@@ -19,6 +19,12 @@
 - **Community PR triage process documented.** CONTRIBUTING.md now includes the wave-based triage pattern: categorize, deduplicate, collector branch, close with context, ship as one PR. References PR #205 as the original example.
 - **Storage redaction test coverage.** Four new tests verify key-based redaction, value-based prefix detection, pass-through for normal values, and length preservation in redacted output.
 
+## [0.10.0.0] - 2026-03-22 — Autoplan
+
+### Added
+
+- **`/autoplan` — one command, fully reviewed plan.** Hand it a rough plan and it runs the full CEO → design → eng review pipeline automatically. Reads the actual review skill files from disk (same depth, same rigor as running each review manually) and makes intermediate decisions using 6 encoded principles: completeness, boil lakes, pragmatic, DRY, explicit over clever, bias toward action. Taste decisions (close approaches, borderline scope, codex disagreements) surface at a final approval gate. You approve, override, interrogate, or revise. Saves a restore point so you can re-run from scratch. Writes review logs compatible with `/ship`'s dashboard.
+
 ## [0.9.9.0] - 2026-03-21 — Harder Office Hours
 
 ### Changed