Merge origin/main v1.91.18.0 (#3023) into the v1.91.19.0 wave

Resolutions:
- design-doc discovery: main's bin/gstack-design-doc-find replaces the inline
  block; it keeps #2839 (a root DESIGN.md is the design system, never the
  design doc; only docs/designs/ competes on freshness). Its unit test and
  the F2 harness (now installs the helper) follow.
- design-shotgun: main's $D variants batch, staged under ${TMPDIR:-/tmp}.
- memory ingest: main's scoped consent (scope counts, purge of staged pages
  outside the scope, zero-sessions notice) on the wave's locked state flow;
  the purge runs before the state loads, under the lock.
- setup / render library: --model overlay plus --disabled-skills on every
  Claude render, including main's plain overlay render.
- codex template and constants: the wave's sandbox preflight and unverified
  mode; main's issue-number removals.
- docsync interface: ls-tree (main) and check-ignore (wave) are both reads.
- census pins re-measured on the merged tree: 114 paid files; gate
  behavior census 44 files / 76 shards (periodic-only files skip the gate,
  now including two safety-rule evals); periodic floor 35,742 and release
  sum 58,097 (gate-only files no longer count toward periodic).
- parity caps at measured merged sizes: ship 1.4271, review 1.1981, qa 1.1099.
- generated output regenerated (gen:skill-docs --host all, llms.txt,
  context budget, goldens).

docs/TESTING_INTERNALS.md

@@ -147,7 +147,7 @@ does not substitute for that evidence.
 HTML through `lib/aside-render.ts` / `bin/gstack-render.ts`, which render in
 Aside when `probeAside()` says `READY` and through the browse engine otherwise.
 make-pdf's `*-gate.test.ts` and `test/skill-e2e-diagram.test.ts` (periodic,
-paid) gate on `browserAvailable()` (`make-pdf/test/e2e/browser-available.ts`:
+paid) gate on `browserAvailable()` (`test/helpers/browser-available.ts`:
 `asideAvailable() || resolveBrowseBin() !== null`) — on a Mac they print
 through Aside, on Linux CI through the browse binary `bun run build:gates`
 compiles, and they skip only when neither exists. Only