Merge origin/main (v1.65.0.0 fork port wave 2) into test-evals-ci-speedup

Second overlapping-wave merge; resolutions compose intent:

- TEST_ROOTS: ours is the superset (main also wired ios-qa/daemon/test;
  ours additionally has ios-qa/scripts + browser-skills). package.json
  'test' keeps routing through the canonical strict runner.
- gbrainAvailable: main fixed the same load-flake with a strictly better
  mechanism (memoized stat-based PATH scan, no subprocess at all) —
  theirs supersedes this branch's memoized-exec probe. Main also made
  the query timeout env-overridable (GSTACK_BRAIN_TIMEOUT_MS).
- Model defaults: adopted main's lib/eval-model.ts abstraction (one
  resolution point, env-overridable per kind) and applied decision D1a
  inside it: capture defaults to Sonnet (Opus opt-in via explicit arg or
  GSTACK_EVAL_MODEL_CAPTURE); test pins updated to follow.
- Parent watchdog: main's rewrite (named parameterized tick, driven
  deterministically by its test via __testInternals__, plus handoff
  suppression semantics from session persistence) supersedes this
  branch's env-tunable interval; adopted their server + test wholesale.
- windows-free-tests: ours (curated bun run test:windows) — main's
  hand-list grew by one more file, which the curated runner subsumes
  automatically; that drift is the reason for D11.
- context-skills 0-for-26 fix: both waves made the IDENTICAL fix; kept
  this branch's comment (carries the receipts).
- .gitignore: main's superset (also ignores Package.resolved — their
  never-commit call; untracked the copy this branch had committed).

Verified: 239-test merge battery green, watchdog 8/8, eval-model 5/5,
actionlint clean, eval:select works.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,44 @@
+<!--
+gstack is AI-coded and proud of it. The bar is EVIDENCE OF REAL USE, not lines
+of code. A PR with no proof behind it gets closed, no matter how clean it looks.
+Fill every section below. See CONTRIBUTING.md → "The evidence bar".
+-->
+
+## Why (in your own words)
+
+<!-- One paragraph: what breaks for a user today, and what this change does about
+it. Not a restatement of the diff. -->
+
+## Live evidence
+
+<!-- REQUIRED. Paste the command(s) you ran and their real output — before and
+after. For a bug: the reproduction, failing then fixed. For a skill change: the
+actual transcript / `claude -p` output. For anything visual: before/after
+screenshots. "bun test passes" alone is not enough — show the behavior you
+changed. -->
+
+```
+# what you ran + what it produced
+```
+
+## Scope
+
+- **Changed:**
+- **Verified live by:**
+- **Did NOT test:**
+
+## Liveness proof (required)
+
+<!-- Attach a screenshot of your own machine with the text `GSTACK PR` typed LIVE
+into a real surface — terminal prompt, a shell command, your browser
+address/search bar, an editor buffer. It must be TYPED INTO A LIVE UI, not drawn,
+overlaid, or edited onto the image. A painted-on `GSTACK PR` is an automatic
+close. This confirms a human opened this PR. -->
+
+## Checklist
+
+- [ ] Liveness screenshot attached: `GSTACK PR` typed live into a real surface (not edited onto the image)
+- [ ] This is not a generated-file-only diff (I edited the source/template and regenerated)
+- [ ] No ETHOS.md edits, and no changes to voice / founder perspective / YC references
+- [ ] New public command / external service / host adapter has an accepted issue linked (or N/A)
+- [ ] Linked issue or reproduction: #

.github/dependabot.yml

@@ -0,0 +1,25 @@
+version: 2
+
+updates:
+  - package-ecosystem: "bun"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    groups:
+      production-dependencies:
+        dependency-type: "production"
+      development-dependencies:
+        dependency-type: "development"
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    open-pull-requests-limit: 2

.github/scripts/gate-secret-scan.mjs

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+import { spawn } from "node:child_process";
+
+const child = spawn("bun", [
+  "bin/gstack-redact",
+  "--repo-visibility", "public",
+  "--json",
+  "--max-bytes", "16000000",
+], { shell: false, windowsHide: true, stdio: ["pipe", "pipe", "inherit"] });
+let diff = "";
+process.stdin.setEncoding("utf8");
+process.stdin.on("data", (chunk) => { diff += chunk; });
+process.stdin.once("end", () => {
+  const additions = diff
+    .split(/\r?\n/)
+    .filter((line) => line.startsWith("+") && !line.startsWith("+++"))
+    .map((line) => line.slice(1))
+    .join("\n");
+  // The scanner may exit before consuming an oversize payload (it refuses
+  // stdin over --max-bytes and reports oversize:true). EPIPE here is that
+  // refusal in flight, not a failure — the report + exit code carry the verdict.
+  child.stdin.on("error", (error) => {
+    if (error.code !== "EPIPE") throw error;
+  });
+  child.stdin.end(additions);
+});
+let stdout = "";
+child.stdout.setEncoding("utf8");
+child.stdout.on("data", (chunk) => { stdout += chunk; });
+child.once("error", (error) => { throw error; });
+child.once("close", (code) => {
+  let report;
+  try {
+    report = JSON.parse(stdout);
+  } catch {
+    // No parseable report: the oversize refusal prints only to stderr and
+    // exits 3, and a crashed scanner emits nothing. Both fail closed.
+    console.log(`credential scan: 1 high, 0 advisory (scanner emitted no report, exit ${code} — fail-closed)`);
+    process.exitCode = 1;
+    return;
+  }
+  const high = Number(report.counts?.HIGH ?? 0);
+  const medium = Number(report.counts?.MEDIUM ?? 0);
+  console.log(`credential scan: ${high} high, ${medium} advisory`);
+  process.exitCode = high > 0 || report.oversize || ![0, 2, 3].includes(code) ? 1 : 0;
+});

.github/workflows/dependency-review.yml

@@ -0,0 +1,32 @@
+name: Dependency Review
+
+on:
+  pull_request:
+    paths:
+      - 'package.json'
+      - 'bun.lock'
+      - '**/package.json'
+      - '**/bun.lock'
+      - '.github/workflows/**'
+
+concurrency:
+  group: dependency-review-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubicloud-standard-8
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
+        with:
+          fail-on-severity: high
+          fail-on-scopes: runtime, development
+          comment-summary-in-pr: on-failure

.github/workflows/evals.yml

@@ -15,6 +15,12 @@ env:
 jobs:
   # Build Docker image with pre-baked toolchain (cached — only rebuilds on Dockerfile/lockfile change)
   build-image:
+    # Dependabot-triggered pull_request runs get a read-only GITHUB_TOKEN, so
+    # a lockfile bump = new hash = failed ghcr push = permanently red check
+    # (EV6, fork port wave 2). Skip the build for dependabot; the evals job's
+    # needs-chain tolerates it because no eval test selects on a lockfile-only
+    # diff — a maintainer's next push rebuilds the image with real perms.
+    if: github.actor != 'dependabot[bot]'
     runs-on: ubicloud-standard-8
     permissions:
       contents: read

.github/workflows/osv-scanner.yml

@@ -0,0 +1,26 @@
+name: OSV Scanner
+
+on:
+  schedule:
+    - cron: '23 7 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: osv-scanner
+  cancel-in-progress: true
+
+jobs:
+  scan:
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@3adb4b14a2b0623876d18d863a498b785fb3752d # v2.3.8
+    with:
+      scan-args: |-
+        --include-git-root
+        --recursive
+        ./

.github/workflows/quality-gate.yml

@@ -0,0 +1,77 @@
+# Quality gate (fork port wave 2, adapted from time-attack/gstack GStack 2).
+#
+# Three generic hygiene checks the repo previously had nowhere in CI:
+#   1. Credential scan of the PR diff's ADDED lines through our own
+#      bin/gstack-redact (HIGH fails the check; MEDIUM is an advisory count —
+#      there is no human in CI to confirm, so it never fails here).
+#   2. bun audit at critical severity.
+#   3. ShellCheck (errors only) on the setup/build shell boundary.
+#
+# Trigger is `pull_request`, NEVER `pull_request_target`: fork PRs must not
+# get secret-bearing contexts. Diff excludes cover the planted-bug fixtures
+# and eval baselines that intentionally contain credential-shaped strings.
+name: Quality gate
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: quality-gate-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  quality:
+    runs-on: ubicloud-standard-8
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: latest
+
+      - name: Install frozen dependencies
+        run: bun install --frozen-lockfile --ignore-scripts
+
+      - name: Scan changed text for credentials (added lines, own redact engine)
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: |
+          set -euo pipefail
+          if ! git cat-file -e "${BASE_SHA}^{commit}" 2>/dev/null; then
+            BASE_SHA=$(git rev-parse HEAD^)
+          fi
+          git diff --unified=0 --no-color "$BASE_SHA" "$HEAD_SHA" -- \
+            . \
+            ':(exclude)test/fixtures/**' \
+            ':(exclude)browse/test/fixtures/**' \
+            ':(exclude)docs/evals/**' \
+            ':(exclude)test/helpers/security-bench*' \
+            | node .github/scripts/gate-secret-scan.mjs
+
+      - name: Gate critical dependency advisories
+        run: bun audit --audit-level=critical
+
+      - name: Install ShellCheck
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y shellcheck
+          shellcheck --version
+
+      - name: ShellCheck setup and build boundaries
+        run: >-
+          shellcheck --severity=error
+          setup
+          scripts/build.sh
+          scripts/build-app.sh
+          scripts/write-version-files.sh
+          browse/scripts/build-node-server.sh