chore: remove dead bins; extend the stale-ref scan to docs (the 36-release gap)

bin/chrome-cdp, bin/gstack-open-url, and bin/gstack-platform-detect were
referenced only by an audit test and CHANGELOG history — dead weight that
the stale-ref scanner should police, which required removing them FIRST.
The scanner now also sweeps docs/, README.md, and USING_GBRAIN_WITH_GSTACK
— the deliberate exclusion that let a dead command survive ~36 releases as
a command-not-found instruction. Scan is green on the extended surface.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/audit-compliance.test.ts

@@ -109,12 +109,6 @@ describe('Audit compliance', () => {
   });
 
   // Round 2 Fix 4: Chrome CDP binds to localhost only
-  test('chrome-cdp binds to localhost only', () => {
-    const cdp = readFileSync(join(ROOT, 'bin/chrome-cdp'), 'utf-8');
-    expect(cdp).toContain('--remote-debugging-address=127.0.0.1');
-    expect(cdp).toContain('--remote-allow-origins=');
-  });
-
   // Fix 2+6: All generated SKILL.md files with telemetry are conditional
   test('all generated SKILL.md files with telemetry calls use conditional pattern', () => {
     const skills = getAllSkillMds();

test/no-stale-gstack-brain-refs.test.ts

@@ -88,6 +88,12 @@ const SCAN_PATHS = [
   'review/SKILL.md.tmpl',
   'ship/SKILL.md.tmpl',
   'test/',
+  // Fork port wave 2: docs were deliberately excluded and that exact gap let
+  // a dead command (gstack-brain-init) survive ~36 releases as a
+  // command-not-found instruction. Docs are user-facing surface; scan them.
+  'docs/',
+  'README.md',
+  'USING_GBRAIN_WITH_GSTACK.md',
 ];
 
 function grepRefs(pattern: string): string[] {