merge: incorporate origin/main into community-mode branch

Conflicts resolved:
- VERSION: keep 0.13.0.0 (branch > main's 0.12.12.0)
- package.json: same version resolution
- CHANGELOG.md: keep both entries — 0.13.0.0 on top, then 0.12.12.0/11.0/10.0
- scripts/gen-skill-docs.ts: keep resolvers-based architecture, drop main's
  inline Codex helper duplicates (already in scripts/resolvers/codex-helpers.ts)

Main brought in: security audit compliance (conditional telemetry, credential
cleanup, dead code removal), skill prefix choice, Codex filesystem boundary,
audit regression tests.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

package.json

@@ -31,7 +31,8 @@
     "eval:summary": "bun run scripts/eval-summary.ts",
     "eval:watch": "bun run scripts/eval-watch.ts",
     "eval:select": "bun run scripts/eval-select.ts",
-    "analytics": "bun run scripts/analytics.ts"
+    "analytics": "bun run scripts/analytics.ts",
+    "test:audit": "bun test test/audit-compliance.test.ts"
   },
   "dependencies": {
     "diff": "^7.0.0",