toothpaste-kit 0.4.0

A MINOR release under docs/releasing.md: three new skills, three new scripts, each
with a gate, and the issue #11 fix, which carries one BREAKING skill change. The
scripts/reorient selftest rows for planted positives (pull request #20) were
added after the 2026-10-09 cutoff and change the selftest only.

Added

• skills/merge-proxy/, a seventh procedure a person invokes. For the session
  it is invoked in, an agent may run and push a merge into a trunk on a
  repository whose remote is internal or absent, after explaining the whole
  plan and halting for approval of each merge. Never on a GitHub or other
  internet remote. The decision stays the person's; only the typing moves.
• scripts/remote-level.sh, the remote classifier merge-proxy runs first:
  none, internal or external from where a repository's remotes point,
  external whenever a host cannot be proven internal. A ninth gate runs its
  --selftest.
• skills/weekly-review/. A once-a-week pass over a task board's slower lanes:
  each Waiting blocker chased, carried work named by its count, the Done lane
  read back against each task's own verification, and one important task given
  a day, never a due date. It proposes and asks; it moves nothing the person
  did not answer.
• skills/monthly-review/. A once-a-month pass: each Someday/Maybe item
  adopted, kept or rejected, long-stalled Waiting work questioned, and the
  tool's archive candidates chosen by the person, leaving as reference or as
  trash. The only review that archives a task the board has been holding, and trash
  never satisfies a dependency (v2, after a second-party check of v1).
• scripts/reorient, the observing half of skills/orient/, which shipped
  without it. Paths come from the workspace's CLAUDE.md and manifest; mail is
  off unless REORIENT_INBOX_REPO is set. A tenth gate runs its --selftest
  on examples/workspace/ and against planted positives, among them mail on a
  sibling branch, a flag filed below Resolved, and a runbook named like a
  capture. orient v2 names it.
• docs/releasing.md says how a skill is versioned and retired (MINOR, a new
  release rule that leaves existing usage working). Three new sections: Skill
  revisions, where a skill's vN lives only in its own CHANGELOG.md and each
  release names the skills whose revision moved; A skill's interface, six
  surfaces, including when a skill fires, and what counts as breaking, labeled
  BREAKING pre-1.0; and Deprecation, announced in one release and removable no
  earlier than the second after it, with experimental skills exempt while the
  kit is pre-alpha. Release notes gain a Deprecated heading.
• docs/installing.md, the installing guide: where each part of the kit goes
  among Claude Code's features, workspace-level against user-level skills and
  why a user-level copy shadows a workspace one, symlink or copy,
  CLAUDE.local.md, enabling the hooks through the hookify plugin, updating,
  removing, and how a workspace grows (a place for unsorted imports, a
  repository, tiers). Reported in issue #11.
• examples/workspace/: the workspace the quickstart copies. CLAUDE.md
  naming the provenance layer and the manifest, index.md, and stubs of the
  standing files under .agents/, each holding comments rather than content.
• An eighth gate, scripts/check-workspace-stubs.py: every stub in
  examples/workspace/ is a file docs/standing-documents.md describes, every
  described file has a stub or a stated exemption, and the stub index.md
  lists every stub under .agents/. It has a planted positive in
  scripts/gates.sh --selftest.
• docs/releasing.md step 9 deletes the release branch once the release is
  published and the local main is pulled.

Changed

• README.md and docs/project-state.md list eighteen skills, with
  merge-proxy, weekly-review and monthly-review among those a person
  invokes; docs/project-state.md and CONTRIBUTING.md describe ten gates,
  with remote-level.sh and reorient under scripts/.
• docs/quickstart.md is one path in six steps, from checking the
  prerequisites to a session log on disk, each step ending with what you should
  now see. It clones the kit, copies examples/workspace/,
  and installs the skills into the workspace with scripts/link-skills.sh. Alternatives, and
  the material on growing a workspace, moved to docs/installing.md. The
  quickstart no longer creates intake/; the guide says what it is for.
  Reported in issue #11.
• README.md: "Installing the skills" points to the quickstart and the
  installing guide instead of carrying its own cp command, the hooks/
  section says the rules need the hookify plugin, and a new examples/
  section describes the example workspace.
• CONTRIBUTING.md lists what scripts/gates.sh needs, and its em dash
  check no longer uses grep -P, which only GNU grep has.
• docs/project-state.md names the example workspace and gains an "In v0.4.0"
  section.
• skills/daily-review/ v2: its Scope Pointer names weekly-review as
  shipped.
• skills/daily-review/ v3 and skills/weekly-review/ v2: the lanes table
  and Scope Pointer (daily) and the Scope Pointer (weekly) name
  monthly-review as shipped. No change to either procedure.
• Every skills/*/CHANGELOG.md relabeled to the shape docs/releasing.md now
  states (PATCH, no entry text changed): one integer vN per heading, unique,
  newest first, title # CHANGELOG. Renumbered: document-standards second
  v2 to v4 (was v2), redaction-gate v2.1 to v3 (was v2.1), and
  daily-review v1.1 to v2. Reordered newest first: document-standards,
  skill-creation, surface-regimes, technical-documents,
  working-preferences.

Fixed

• scripts/gates.sh: the em dash and private task ID gates searched .git,
  because --exclude-dir followed -- and was read as a file name, and
  passed when grep could not run at all. Both now fail on a grep error,
  and the selftest runs the two gates themselves on a planted tree instead of
  a copy of their command line.
• BREAKING skills/session-close/ v5: phase 1 writes provenance to the
  layer the tree's CLAUDE.md names instead of a path from the tree it was
  written in; the phase 3 dash sweeps no longer need GNU grep; and the memory
  store check is stated as the source tree's example, to be substituted, and
  reported as not applicable where a tree keeps no store. Reported in
  issue #11.
  Migration: name your provenance layer in your CLAUDE.md; where it names
  none, the skill now stops and asks instead of writing to
  agents/claude/context/. It skips the deprecation window as a safety fix:
  the old default could put session reasoning in a repository that later
  gains a public remote.
• skills/session-log/ v2: it writes no em dash, headings included, so
  session-close no longer has to correct its captures. Reported in issue #11.

Skill revisions

• daily-review v1 to v3.
• merge-proxy v1, new.
• monthly-review v2, new (v1 and v2 both in this release).
• orient v1 to v2.
• session-close v4 to v5, BREAKING.
• session-log v1 to v2.
• weekly-review v2, new (v1 and v2 both in this release).