fix(setup): render the gbrain :user variant to an out-dir — global installs stay git-clean

On a global-git install with gbrain, ./setup and 'gstack-config
gbrain-refresh' ran gen:skill-docs:user IN PLACE inside the install
checkout, rewriting ~16 TRACKED SKILL.md files. The checkout stayed
permanently dirty, every /gstack-upgrade 'git stash' saved a redundant
snapshot of generated content, and the growing stash list invited a 'git
stash pop' that would lay stale instruction markdown from an older gstack
over the current version — a quiet wrong-rules failure mode.

Fix, wired through machinery that already existed (gen-skill-docs
--out-dir + the symlink install layer): brain-aware SKILL.md now renders
into the untracked ~/.gstack/render/claude, and both Claude installers
serve the render when present — setup's link_claude_skill_dirs prefers
$GSTACK_HOME/render/claude/<skill>/SKILL.md, and bin/gstack-relink does
the same so a later config change can't silently flip skills back to the
blockless canonical source. setup wipes and rebuilds the render each run,
repoints installed skills after a successful render, and removes a stale
render (re-linking canonical) when gbrain is gone. gbrain-refresh renders
to the out-dir and repoints via relink; its 'this dirties the install's
git tree' caveat is retired because it no longer does.

A one-time upgrade migration (gstack-upgrade/migrations/v1.67.0.0.sh, F12)
restores the legacy dirt: unstaged modifications to SKILL.md / sections/
*.md files in the install checkout are git-checkout'd back to canonical;
anything outside that footprint (user edits, untracked files, staged work)
is left alone and reported. Idempotent, non-fatal, symlinked installs
skipped.

Tests: render-preference behavior for both installers, static pins that
every executable :user invocation carries --out-dir and the caveat text is
gone, migration fixture (restore/leave/idempotent/no-op matrix), and the
existing out-dir render test now asserts 'git status --porcelain' gains
zero new entries across a full :user render.

Fixes #2569

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/gen-skill-docs-out-dir.test.ts

@@ -20,11 +20,17 @@ describe('gen-skill-docs --out-dir (B2 render isolation)', () => {
     return createHash('sha256').update(fs.readFileSync(p)).digest('hex');
   }
 
+  function porcelain(): string {
+    const r = spawnSync('git', ['status', '--porcelain'], { cwd: ROOT, encoding: 'utf-8' });
+    return r.status === 0 ? r.stdout : '';
+  }
+
   test('renders :user to out-dir, rewrites section paths, leaves worktree canonical', () => {
     const tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-home-'));
     const outDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-out-'));
     const worktreeSkill = path.join(ROOT, 'ship', 'SKILL.md');
     const beforeHash = hashFile(worktreeSkill);
+    const beforePorcelain = porcelain();
     try {
       // Force gbrain detection ON for --respect-detection.
       fs.writeFileSync(
@@ -47,6 +53,11 @@ describe('gen-skill-docs --out-dir (B2 render isolation)', () => {
       // (a) worktree byte-unchanged
       expect(hashFile(worktreeSkill)).toBe(beforeHash);
 
+      // (a2, #2569) the render adds ZERO new dirt to the source checkout —
+      // compared before/after rather than asserting empty, so a dev's own
+      // unrelated dirty files can't false-fail the suite.
+      expect(porcelain()).toBe(beforePorcelain);
+
       // (b) inline block present in the rendered SKILL.md
       expect(skillContent).toContain('Brain Context Load');