merge: origin/main v1.1.1.0 into garrytan/fix-checkpoints

Main shipped the /ship VERSION/package.json drift-detection fix as
v1.1.1.0 — exact collision with our branch's existing version. Bumped
ours to 1.1.2.0.

Resolved conflicts:
- VERSION: 1.1.1.0 → 1.1.2.0
- package.json: 1.1.1.0 → 1.1.2.0
- CHANGELOG.md: moved our /checkpoint → /context-save entry up one
  header level to [1.1.2.0] and kept main's /ship drift-fix entry
  at [1.1.1.0]. Sequence now: 1.1.2.0 → 1.1.1.0 → 1.1.0.0 → 1.0.0.0.
- Migration renamed v1.1.1.0.sh → v1.1.2.0.sh (version string inside
  and test path reference both updated).

Also bumped the /context-save + /context-restore CHANGELOG entry to
credit the adversarial-review hardening wave (HOME guard, realpath
fallback, title sanitize, collision-safe filenames, context-restore
head cap, autoplan test regex tightening) as contributor-facing notes
— previous entry didn't reflect the security work that landed after
the initial ship.

No overlap between main's /ship Step 12 logic and this branch's work.
SKILL.md files regenerated via bun run gen:skill-docs --host all.
Golden fixtures updated.

bun test: 0 failures across 80+ targeted tests and the full suite.
Migration ownership guard: 7/7 pass (~85ms).

TODOS.md

@@ -455,6 +455,30 @@ Linux cookie import shipped in v0.11.11.0 (Wave 3). Supports Chrome, Chromium, B
 
 ## Ship
 
+### /ship Step 12 test harness should exec the actual template bash, not a reimplementation
+
+**What:** `test/ship-version-sync.test.ts` currently reimplements the bash from `ship/SKILL.md.tmpl` Step 12 inside template literals. When the template changes, both sides must be updated — exactly the drift-risk pattern the Step 12 fix is meant to prevent, applied to our own testing strategy. Replace with a helper that extracts the fenced bash blocks from the template at test time and runs them verbatim (similar to the `skill-parser.ts` pattern).
+
+**Why:** Surfaced by the Claude adversarial subagent during the v1.0.1.0 ship. Today the tests would stay green while the template regresses, because the error-message strings already differ between test and template. It's a silent-drift bug waiting to happen.
+
+**Context:** The fixed test file is at `test/ship-version-sync.test.ts` (branched off garrytan/ship-version-sync). Existing precedent for extracting-from-skill-md is at `test/helpers/skill-parser.ts`. Pattern: read the template, slice from `## Step 12` to the next `---`, grep fenced bash, feed to `/bin/bash` with substituted fixtures.
+
+**Effort:** S (human: ~2h / CC: ~30min)
+**Priority:** P2
+**Depends on:** None.
+
+### /ship Step 12 BASE_VERSION silent fallback to 0.0.0.0 when git show fails
+
+**What:** `BASE_VERSION=$(git show origin/<base>:VERSION 2>/dev/null || echo "0.0.0.0")` silently defaults to `0.0.0.0` in any failure mode — detached HEAD, no origin, offline, base branch renamed. In such states, a real drift could be misclassified or silently repaired with the wrong value. Distinguish "origin/<base> unreachable" from "origin/<base>:VERSION absent" and fail loudly on the former.
+
+**Why:** Flagged as CRITICAL (confidence 8/10) by the Claude adversarial subagent during the v1.0.1.0 ship. Low practical risk because `/ship` Step 3 already fetches origin before Step 12 runs — any reachability failure would abort Step 3 long before this code runs. Still, defense in depth: if someone invokes Step 12 bash outside the full /ship pipeline (e.g., via a standalone helper), the fallback masks a real problem.
+
+**Context:** Fix: wrap with `git rev-parse --verify origin/<base>` probe; if that fails, error out rather than defaulting. Touches `ship/SKILL.md.tmpl` Step 12 idempotency block (around line 409). Tests need a case where `git show` fails.
+
+**Effort:** S (human: ~1h / CC: ~15min)
+**Priority:** P3
+**Depends on:** None.
+
 ### GitLab support for /land-and-deploy
 
 **What:** Add GitLab MR merge + CI polling support to `/land-and-deploy` skill. Currently uses `gh pr view`, `gh pr checks`, `gh pr merge`, and `gh run list/view` in 15+ places — each needs a GitLab conditional path using `glab ci status`, `glab mr merge`, etc.