fix: deep-review remediation (batch A) + problem-solver skill

[CodeWithJuber]

What & why

Remediation of findings from the deep full review, plus a new bundled skill. Each commit
keeps all four guardrails green: 1069 tests pass, typecheck, biome, and docs check.

Commit 1 — Batch A (verified, low-risk fixes)

• H4 — broke the static ESM import cycle recall → ledger_read → lessons_store → recall (import hasSecret from secrets.js directly; drop the re-export).
• H2 — test/init.test.js pins settingsPath under a temp dir so the hook-guard
  merge never mutates the developer's real ~/.claude/settings.json.
• H1 — release.yml is now closed-loop: per-ref concurrency, idempotent publish +
  Release creation, and a final step that FAILS the job when a tag didn't produce both a
  GitHub Release and (when publishing is enabled) an npm version. Orphan tags
  v0.22.2/v0.23.2/v0.24.0 documented in docs/RELEASING.md.
• M1 — the top-level run() is guarded behind a symlink-resolving main-module check
  and run is exported, so importing the package root no longer executes the CLI;
  package.json sideEffects names the CLI entry accurately.
• M4 — consolidated four byte-identical git() helpers + the ledger store's
  readJson into src/util.js.
• LOW — dead plugin files entry, vestigial .gitlab-ci.yml, dangling @AGENTS.md
  import, off-palette Codex brandColor, literal NUL bytes → \0, non-zero stub exit.

Commit 2 — problem-solver skill

• problem-solver (global/tools/problem-solver/) — a universal, framework-driven
  problem-solving cycle bundled through the plugin's skills directory. English naming.

Commit 3 — Phase 4 cleanups

• M5 — applyPrimaryTool (repo_config.js) no longer dynamically imports the sync
  compiler; the sync runner is injected by cli.js, keeping the config leaf acyclic.
• M12 — refreshed ARCHITECTURE.md for the missing v0.20–v0.24 modules (commit_gate,
  consensus, knowledge_router, deja, docs_impact).
• LOW — git cat-file -e ref resolver passes -- before the ref.

Deferred to dedicated follow-up PRs (not in this PR)

• H3 — the full 44-branch physical split of run() (2.4k-line god-function). Large,
  high-churn; the M1 main-module guard already shipped here.
• M2 — flipping the FORGE_LEDGER_ONLY default and deleting the legacy memory stores.
  Carries data-loss risk (destructive consolidate/reconcile heuristics) and needs isolated review.
• A few LOW items left as noted follow-ups (gitleaks binary checksum — couldn't verify the
  release asset names without authenticated GitHub access; strict:true typecheck ramp;
  unexporting internal-only symbols).

Checklist

• npm test passes (1069 pass / 0 fail / 2 gated skips)
• npm run check passes (Biome lint + format)
• Conventional commit messages
• CHANGELOG.md updated under ## [Unreleased]
• No new runtime dependency
• Substrate/docs updated where affected (docs/RELEASING.md, ARCHITECTURE.md)

Risk & rollback

• Risk level: low
• Rollback plan: revert the commits on this branch; no data migrations, no schema changes.

Extra checks

• npm run typecheck passes
• Input validated at boundaries; errors handled (no swallowing)
• Logs contain no secrets/PII
• If AI-assisted: I understand it, verified the APIs, and it stays test-covered

🤖 Generated with Claude Code

https://claude.ai/code/session_01C7htTiesXKLvAUtv6ET2jz