fix(setup): reap dangling skill dirs when the payload is gone

cleanup_old_claude_symlinks derived its work list from the payload directory, so when the payload was gone — precisely when orphans exist — the glob matched nothing and the loop never ran; the -f guard also followed symlinks, hiding dangling SKILL.md links even with a payload present. The cleanup now scans the DESTINATION skills dir (-e/-L, so dangling symlinks are visible) and anchors SKILL.md provenance to path segments (gstack/*, */gstack/*, */.gstack/render/claude/*) instead of a bare *gstack* substring that would eat a user skill under ~/tools/gstack-fork/. The Windows real-file arm stays payload-gated: a real file has no provable owner.

Absorbed from PR #2634 (2 commits squashed) with authorship preserved. The symmetric cleanup_prefixed_claude_symlinks hole is filed as a TODOS.md residual in this wave.

Fixes #2204

setup

@@ -973,45 +973,67 @@ link_claude_root_skill_alias() {
 # ─── Helper: remove old unprefixed Claude skill entries ───────────────────────
 # Migration: when switching from flat names to gstack- prefixed names,
 # clean up stale symlinks or directories that point into the gstack directory.
+# Scan $skills_dir (not $gstack_dir): orphans live next to the payload, so a
+# missing payload must still be able to reap leftover flat names (#2204).
 cleanup_old_claude_symlinks() {
   local gstack_dir="$1"
   local skills_dir="$2"
   local removed=()
-  for skill_dir in "$gstack_dir"/*/; do
-    if [ -f "$skill_dir/SKILL.md" ]; then
-      skill_name="$(basename "$skill_dir")"
-      [ "$skill_name" = "node_modules" ] && continue
-      # Skip already-prefixed dirs (gstack-upgrade) — no old symlink to clean
-      case "$skill_name" in gstack-*) continue ;; esac
-      old_target="$skills_dir/$skill_name"
-      # Remove directory symlinks pointing into gstack/
-      if [ -L "$old_target" ]; then
-        link_dest="$(readlink "$old_target" 2>/dev/null || true)"
-        case "$link_dest" in
-          gstack/*|*/gstack/*)
-            rm -f "$old_target"
-            removed+=("$skill_name")
-            ;;
-        esac
-      # Remove real directories with symlinked SKILL.md pointing into gstack/
-      elif [ -d "$old_target" ] && [ -L "$old_target/SKILL.md" ]; then
-        link_dest="$(readlink "$old_target/SKILL.md" 2>/dev/null || true)"
-        case "$link_dest" in
-          *gstack*)
-            rm -rf "$old_target"
-            removed+=("$skill_name")
-            ;;
-        esac
-      # Windows install pattern: real dir with real-file SKILL.md (no symlink
-      # available, so we can't readlink to verify provenance). The outer loop
-      # iterates known gstack skill names from "$gstack_dir"/*, so a name match
-      # plus IS_WINDOWS is safe to treat as gstack-managed during a mode flip.
-      elif [ "$IS_WINDOWS" -eq 1 ] && [ -d "$old_target" ] && [ -f "$old_target/SKILL.md" ]; then
-        rm -rf "$old_target"
-        removed+=("$skill_name")
-      fi
+  local old_target skill_name link_dest skill_dir
+  # Destination scan. The glob already yields dangling dir symlinks; [ -e ]
+  # alone would skip them, so [ -L ] keeps those entries. An unmatched `*`
+  # literal (empty skills_dir) is rejected by the same guard.
+  for old_target in "$skills_dir"/*; do
+    [ -e "$old_target" ] || [ -L "$old_target" ] || continue
+    skill_name="$(basename "$old_target")"
+    [ "$skill_name" = "node_modules" ] && continue
+    [ "$skill_name" = "gstack" ] && continue
+    # Skip already-prefixed dirs (gstack-upgrade) — no old symlink to clean
+    case "$skill_name" in gstack-*) continue ;; esac
+    # Remove directory symlinks pointing into gstack/
+    if [ -L "$old_target" ]; then
+      link_dest="$(readlink "$old_target" 2>/dev/null || true)"
+      case "$link_dest" in
+        gstack/*|*/gstack/*)
+          rm -f "$old_target"
+          removed+=("$skill_name")
+          ;;
+      esac
+    # Remove real directories with symlinked SKILL.md pointing into gstack/
+    elif [ -d "$old_target" ] && [ -L "$old_target/SKILL.md" ]; then
+      link_dest="$(readlink "$old_target/SKILL.md" 2>/dev/null || true)"
+      # Anchored path segments (same as the dir-symlink arm and
+      # gstack-uninstall #2563). A bare *gstack* substring would wipe a
+      # user skill under e.g. ~/tools/gstack-fork/. Also accept the #2569
+      # render prefix (~/.gstack/render/claude/...), which is not `/gstack/`.
+      case "$link_dest" in
+        gstack/*|*/gstack/*|*/.gstack/render/claude/*)
+          rm -rf "$old_target"
+          removed+=("$skill_name")
+          ;;
+      esac
     fi
   done
+  # Windows install pattern: real dir with real-file SKILL.md (no symlink
+  # available, so we can't readlink to verify provenance). Iterate known
+  # gstack skill names from "$gstack_dir"/*, so a name match plus IS_WINDOWS
+  # is safe to treat as gstack-managed during a mode flip. When the payload
+  # is gone this branch is a no-op — a real file has no proven owner.
+  if [ "${IS_WINDOWS:-0}" -eq 1 ] && [ -d "$gstack_dir" ]; then
+    for skill_dir in "$gstack_dir"/*/; do
+      if [ -f "$skill_dir/SKILL.md" ]; then
+        skill_name="$(basename "$skill_dir")"
+        [ "$skill_name" = "node_modules" ] && continue
+        case "$skill_name" in gstack-*) continue ;; esac
+        old_target="$skills_dir/$skill_name"
+        if [ -d "$old_target" ] && [ ! -L "$old_target" ] \
+          && [ -f "$old_target/SKILL.md" ] && [ ! -L "$old_target/SKILL.md" ]; then
+          rm -rf "$old_target"
+          removed+=("$skill_name")
+        fi
+      fi
+    done
+  fi
   if [ ${#removed[@]} -gt 0 ]; then
     echo "  cleaned up old entries: ${removed[*]}"
   fi