Finish the cleanup: isolate publish, explain the scan verdict, consolidate the changelog

Andrew Dunnrequested to merge
cleanup/final into main

Six commits finish the cleanup series.

  • Move publish into publish.just, which no pre-approved command line loads. lab doctor publish <draft> matched the pre-approved lab form and posted with no prompt. allowed-tools also drops Bash(just sims-check).
  • Record that move as ADR-0007, which amends ADR-0006.
  • Record the single-source restructure fidelity runs: KEEP at a sonnet floor.
  • Explain in SECURITY.md that the raw skillspector verdict stays CRITICAL / DO_NOT_INSTALL and that the skill-scan gate accepts findings by signature and count.
  • Consolidate the unreleased changelog for !66 (merged) to !69 (merged) and this MR, including the knob renames, and name a generic notifier in the 0.3.0 entry.

just ci passes.

Edited by Andrew Dunn

Merge request reports