fix: maintenance-council hardening sweep

[lukas-grigis]

Pre-release hardening batch from a full-repo maintenance audit: 8 auditor roles (correctness, TUI/display, chain framework, provider adapters, release gates, test integrity, security, docs drift) produced 51 findings, deduplicated to 47; every must/should candidate was adversarially re-verified against the code before implementation. 28 verified findings are fixed here; 19 lower-severity ones were filed as issues #288–#306.

Must-fixes

• Chain: an in-branch operator abort no longer degrades to a no-op that keeps launching waves — it stops scheduling, kills in-flight siblings, and propagates the AbortError verbatim
• Providers: rate-limit detection no longer matches assistant prose (a "429" in conversation could discard a landed signals.json and sleep ~36 min); landed signals now beat stdout evidence; unreachable OpenCode model ids fail fast instead of burning the attempt budget
• Security: worktree .git/info/exclude now resolves the common git dir (bundled skills were being committed); AI-supplied skill-suggestions names are sanitized against path traversal at the contract boundary
• TUI: router.reset requires an explicit entry — first-run h/D no longer bounce to Welcome and re-stamp the AI preset; document overlays hard-wrap before windowing so wrapped critiques scroll correctly
• Test gate: vitest pins FORCE_COLOR=0 — pnpm test was reporting 27 false failures whenever the caller's shell exported FORCE_COLOR

Should-fixes

• Diff-scoped post-verify success no longer recorded as a full-tree green baseline (false regressed blocks)
• Evaluator process crashes retry within maxAttempts instead of terminally blocking the task; unblockTask clears best-of-N grant stamps
• Blocked tasks bucket as skipped instead of rendering active; parallel runs show token usage (root-session keying); Welcome esc hint works; status-banner dismiss gated while prompts own the keyboard
• CLI top-level error handler (one-line errors, stack behind debug env); release workflow packs + installs the tarball before publish; CI exercises the bundled-prompt resolver via new ralphctl prompts list
• One loud waitFor contract across the TUI suite (exposed and fixed 2 silently-dead tests); real coverage for pull-request-creator; forensics negative tests await loaded state; entropy-check fixtures match the real loop composition
• Docs drift: four-backend counts, contributor guide, data-model fields, implementFlow trace, README CLI reference, playbook scenarios for the Unreleased features

Verification

• pnpm typecheck / pnpm lint / pnpm test all green — 607 files / 5890 tests (+18 files, +131 tests), passing with FORCE_COLOR=3 exported (previously 27 false failures)
• pnpm build, pnpm deadcode, pnpm format:check clean; every fix ships with a regression test written to fail first

https://claude.ai/code/session_01PHikH4LdejozJdjzTzhPes