Merge remote-tracking branch 'origin/main' into ponytail-inspiration-review

# Conflicts:
#	bin/gstack-config
#	browse/test/path-validation.test.ts
#	package.json
#	test/helpers/carve-guards.ts

qa/SKILL.md

@@ -560,7 +560,13 @@ If `NEEDS_SETUP`:
      BUN_INSTALL_SHA="bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd"
      tmpfile=$(mktemp)
      curl -fsSL "https://bun.sh/install" -o "$tmpfile"
-     actual_sha=$(shasum -a 256 "$tmpfile" | awk '{print $1}')
+     # shasum is macOS/perl; coreutils-only Linux ships sha256sum instead —
+     # resolve whichever exists so the verify never fails on a missing tool.
+     if command -v sha256sum >/dev/null 2>&1; then
+       actual_sha=$(sha256sum "$tmpfile" | awk '{print $1}')
+     else
+       actual_sha=$(shasum -a 256 "$tmpfile" | awk '{print $1}')
+     fi
      if [ "$actual_sha" != "$BUN_INSTALL_SHA" ]; then
        echo "ERROR: bun install script checksum mismatch" >&2
        echo "  expected: $BUN_INSTALL_SHA" >&2