chore(release): cherry-pick fixes onto release/0.2.0 for v0.2.0-rc.5

[bolichen97]

Cherry-picks onto release/0.2.0 for the next insider RC, v0.2.0-rc.5. Every pick is patch-identical to the commit already merged on main (verified with git patch-id --stable).

What is here

Squashed to one commit (48f94b360) for the Enforce single commit gate; every cherry-pick trailer is preserved in the commit message body. Each pick is patch-identical to the commit already merged on main (verified with git patch-id --stable), and the squash left the tree byte-identical.

Upstream PR	Upstream commit	Why it is on this branch
#2340	8f5c937b3	Requested for this RC. kirocrew setup no longer walks through Slack credentials unless --slack is passed, plus multi-channel repositioning across docs, in-app copy, and all 13 locales.
#2378	ab20b4e68	Requested for this RC. Drops shebangs from two website/scripts/*.mjs files that broke test collection on Windows, and adds a regression test.
#2306	841e8b4cb	Required to make this branch green. See below.
#2370	49aa7762b	Follow-up to #2306: Korean spacing convention on sort_largest, matching its sibling keys.
n/a	n/a	Changelog entry for #2340 under the existing ## [0.2.0] section.

This branch was already failing its own frontend gate

Independent of the picks above, release/0.2.0 fails catalogParity > ko at 5fe4bd5af: 29 missing keys and 36 orphaned keys, all under pages.sessionStorage.*.

Cause is a back-port gap, not these cherry-picks. #2208 rewrote the English Storage keys on this branch, but its Korean resync (#2306) stayed on main. The user-visible effect is that Korean users see 29 raw key names on the Storage page while 36 translated strings sit dead in the catalog. #2306's own commit message predicted the CI consequence: both halves of catalogParity fail, which reds Frontend Tests for every pull request touching website/.

Confirmed pre-existing three ways:

• Reproduced against the base tree at 5fe4bd5af with the picks absent.
• The picks touch zero sessionStorage keys (git diff 5fe4bd5af..HEAD -- website/src/i18n/locales/ | grep -c sessionStorage is 0).
• main passes the identical check; this branch does not.

Note for anyone repeating this: copying main's whole ko.json is not the fix, since that file has moved ahead of this branch (it would leave 11 missing / 21 stray). Take #2306's diff.

Verification

Run locally on the staged branch before pushing.

Frontend, all green:

• npx tsc -b, exit 0
• eslint, 0 errors
• npx vitest run src/i18n/, 38 files, 597 passed (catalogParity now green for all 12 locales; jaStyle 14/14)
• npx vitest run, 842 files, 11243 passed, 0 failed
• npm run build, exit 0

Backend:

• flake8 src/kiro_crew test, exit 0
• isort --check-only, exit 0
• mypy --platform linux src/kiro_crew, clean across 850 files. Three local os.*xattr errors are macOS typeshed only; hooks.py is byte-identical at base and HEAD and is untouched by every pick.
• Full suite: 38511 passed, 8 failed. All 8 fail byte-identically at 5fe4bd5af, in files no pick touches, each from a macOS or host artifact: __CF_USER_TEXT_ENCODING injected by the OS, a hardcoded test PID that happens to be live on the dev host, and the credential redactor matching a random macOS tmpdir segment. Linux CI is the authority here.
• The picked areas specifically (test_cli.py, test_cli_gateway_flags.py, all test_session*, all test_slack*): 2561 passed, 0 failed.
• test_changelog_handler.py: 7 passed.

black --check was deliberately not treated as a gate: ci.yml disables it pending a bulk format pass, and the repo is roughly 1100 files from clean at the pinned version.

One process note

#2340 is a feat:, and the model in CONTRIBUTING.md reserves a cut release branch for bug fixes. It is here deliberately, at the maintainer's call, because the multi-channel positioning is the accurate story to have in users' hands for 0.2.0. Flagging it so the deviation is on the record rather than implicit.

After this merges

Tag the branch tip v0.2.0-rc.5 and push it to publish to the insider channel. Nothing in this PR tags anything.

[github-actions]

GPT 5.6 Review — ✅ no blocking findings

GPT 5.6 completed its review of 48f94b360b50110881a4e9ebf35e1f2545c88388 and found no blocking issues.

This comment is updated in place on each push.

Review details

No findings.
[GPT-REVIEWED] 48f94b3

False positive or not applicable? A repository writer can comment:
/ai-review override gpt 48f94b360b50110881a4e9ebf35e1f2545c88388: <one-sentence reason>

[github-actions]

Design Review (Fable 5) — ✅ PASS

Advisory design-level review of 48f94b360b50110881a4e9ebf35e1f2545c88388 — updated in place on each push; does not block merge.

Design-Verdict: PASS

Correct picks via the actual missing commit (#2306) rather than a wholesale ko.json copy; each is main-merged, reversible, and the release-branch feat: deviation is explicitly flagged.

[DESIGN-REVIEWED] 48f94b3

[github-actions]

UX Review (Fable 5) — ✅ PASS

Advisory UX-level review of 48f94b360b50110881a4e9ebf35e1f2545c88388 — updated in place on each push; does not block merge.

UX-Verdict: PASS

Slack demotion is handled cleanly — every removed prompt is replaced by an explicit, accurate pointer, and the Korean resync fixes 29 raw keys users were seeing.

Suggestions

• cli_doctor.py: the hint "connect any channel (Slack, Discord, Telegram, …) from the dashboard" omits where — add "(Settings → Channels)" to match the setup wizard's pointer, so the user isn't left hunting the dashboard.
• suggestion_summarize_chat ("Summarize this week's chat activity") now overlaps its sibling pill "Summarize my recent activity" (visible side-by-side in welcome-chat-activity-pill.png); name the source — e.g. "Summarize this week's channel messages" — so a first-time user can tell the two apart, especially since this same PR makes zero-channels the default install state.

[UX-REVIEWED] 48f94b3

[bolichen97]

Dispositions for the two UX Review suggestions on 48f94b360. Both are accepted-and-deferred, tracked in #2399 — with the same reason, stated per item below.

1. cli_doctor.py hint omits where to connect a channel — accepted-and-deferred to #2399. The suggestion is correct: the setup wizard names its location and this hint does not. Not fixed here because src/kiro_crew/cli_doctor.py at this PR's HEAD is byte-identical to origin/main (verified by blob hash). Editing it would break the patch-identity this PR claims for every pick, and would leave release/0.2.0 carrying a string main does not have — the exact class of divergence that produced the catalogParity > ko breakage this PR is also here to repair.

2. suggestion_summarize_chat overlaps its sibling pill — accepted-and-deferred to #2399. Agreed on the substance, including that it bites harder now that zero connected channels is the default install state. Same reason for deferring, plus a scope one: the string lives in all 13 locale catalogs, so a rename here would mean re-translating 13 files inside a cherry-pick set whose whole warrant is that it matches commits already reviewed and merged on main.

The correct route for both is main, then a back-port into a later RC if the copy is judged release-worthy. Neither is a correctness or accessibility defect, so neither justifies diverging this RC from main.

For the record, this is a cherry-pick PR for insider RC v0.2.0-rc.5, not a feature PR — the bar applied here is "is this the same code that passed review on main", which is why an advisory copy improvement is deferred rather than folded in.

[github-actions]

Opus 5 Review — ✅ no blocking findings

Reviewed 48f94b360b50110881a4e9ebf35e1f2545c88388 — this comment is updated in place on each push.

Review details

No findings.

[OPUS-REVIEWED] 48f94b3

Verdict parsed from the review's SHA-scoped output markers for commit 48f94b360b50110881a4e9ebf35e1f2545c88388.

False positive or not applicable? A repository writer can comment:
/ai-review override fable 48f94b360b50110881a4e9ebf35e1f2545c88388: <one-sentence reason>