merge: incorporate origin/main into community-mode branch

Conflicts resolved:
- VERSION: keep 0.13.0.0 (branch > main's 0.12.12.0)
- package.json: same version resolution
- CHANGELOG.md: keep both entries — 0.13.0.0 on top, then 0.12.12.0/11.0/10.0
- scripts/gen-skill-docs.ts: keep resolvers-based architecture, drop main's
  inline Codex helper duplicates (already in scripts/resolvers/codex-helpers.ts)

Main brought in: security audit compliance (conditional telemetry, credential
cleanup, dead code removal), skill prefix choice, Codex filesystem boundary,
audit regression tests.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

bin/gstack-config

@@ -23,7 +23,9 @@ case "${1:-}" in
     VALUE="${3:?Usage: gstack-config set <key> <value>}"
     mkdir -p "$STATE_DIR"
     if grep -qE "^${KEY}:" "$CONFIG_FILE" 2>/dev/null; then
-      sed -i '' "s/^${KEY}:.*/${KEY}: ${VALUE}/" "$CONFIG_FILE"
+      # Portable in-place edit (BSD sed uses -i '', GNU sed uses -i without arg)
+      _tmpfile="$(mktemp "${CONFIG_FILE}.XXXXXX")"
+      sed "s/^${KEY}:.*/${KEY}: ${VALUE}/" "$CONFIG_FILE" > "$_tmpfile" && mv "$_tmpfile" "$CONFIG_FILE"
     else
       echo "${KEY}: ${VALUE}" >> "$CONFIG_FILE"
     fi