v0.8.1: hardening patch

Highlights

A post-0.8.0 hardening patch. Generated bytes are unchanged for well-formed templates and profiles (frozen byte-identity anchor verified).

• Plugin onboarding fixed: every skill/command doc now teaches python scripts/cli.py ... - a launcher that resolves the engine root from the skill folder AND the repo/plugin root (BRAND_DOCS_ROOT overrides). Fresh plugin sessions no longer trip on a wrong path.
• Example pptx imports in Keynote: python-pptx omits p:notesMasterIdLst when speaker notes are authored; strict importers rejected the package. The builder now repairs it deterministically at build time.
• Engine hardening (with regression tests): caption-index refresh validates both field bounds (a corrupted inventory could corrupt the body via negative indexing); role_id validates its own composition; border-apply refuses mislabeled sides and narrows its catches; set-only-when-unset guards treat empty attributes as unset. A frozen CHECK_REGISTRY pins the QA check-id vocabulary behind an AST-guarded test.
• Example docx visual fixes from a page-by-page render audit: clean solid cover band, landscape appendix no longer inherits the two-column layout, readable white table headers, repeating header rows on page-spanning tables, balanced two-column synopsis.
• Honest speed expectation in the README: first run on a new template up to ~15 minutes end to end with an agent; every later document takes seconds - still a fraction of hand-formatting, with a faithful file instead of an approximate one.

Full detail: CHANGELOG.md