merge: origin/main into garrytan/multi-checkpoint-resume

Catches up 7 commits from main:
- c6e6a21d refactor: AI slop reduction with cross-model quality review (v0.16.3.0)
- 7e96fe29 fix: security wave 3 — 12 fixes, 7 contributors (v0.16.4.0)
- 23000672 feat: UX behavioral foundations + ux-audit command (v0.17.0.0)
- b805aa01 feat: Confusion Protocol, Hermes + GBrain hosts, brain-first resolver (v0.18.0.0)
- 6a785c57 fix: ngrok Windows build + close CI error-swallowing gap (v0.18.0.1)
- 0cc830b6 fix: avoid tilde-in-assignment to silence Claude Code permission prompts
- cc42f14a docs: gstack compact design doc (tabled pending Anthropic API)

Conflict resolution:
- ship/SKILL.md.tmpl line 402: HEAD had "## Step 12: Version bump" from
  the renumber refactor; origin/main added {{GBRAIN_SAVE_RESULTS}} above
  "## Step 4: Version bump". Resolved by keeping origin/main's new
  placeholder AND my branch's "Step 12" heading.
- ship/SKILL.md: regenerated from resolved template (per CLAUDE.md
  policy: never resolve generated files manually).

All skill docs regenerated for all 9 hosts (claude, kiro, opencode,
slate, cursor, openclaw, factory, hermes, gbrain) to reflect the
merged template.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ship/SKILL.md.tmpl

@@ -19,12 +19,19 @@ allowed-tools:
   - AskUserQuestion
   - WebSearch
 sensitive: true
+triggers:
+  - ship it
+  - create a pr
+  - push to main
+  - deploy this
 ---
 
 {{PREAMBLE}}
 
 {{BASE_BRANCH_DETECT}}
 
+{{GBRAIN_CONTEXT_LOAD}}
+
 # Ship: Fully Automated Ship Workflow
 
 You are running the `/ship` workflow. This is a **non-interactive, fully automated** workflow. Do NOT ask for confirmation at any step. The user said `/ship` which means DO IT. Run straight through and output the PR URL at the end.
@@ -392,6 +399,8 @@ For each comment in `comments`:
 
 {{LEARNINGS_LOG}}
 
+{{GBRAIN_SAVE_RESULTS}}
+
 ## Step 12: Version bump (auto-decide)
 
 **Idempotency check:** Before bumping, compare VERSION against the base branch.