v0.2.40

• Risk-config warnings now surface on every ranking entry point: opro analyze , opro gaps, and gaps --json (previously only start), read from the analyzed repository rather than the working directory
• An unreadable .orangepro/config.json aborts analyze with the file path and a hint (JSON does not allow // comments) instead of a bare parse error
• Surface tests exercise opAnalyze and opGaps in both usage patterns (in-repo and analyze-a-path-from-elsewhere)
• No scoring or evidence changes