pstack-hermes v0.4.3

Added

• publish-plugin.yml: CI publisher that publishes the validated built package to the plugin-only dist repo iap/pstack (build output; append-only commits so installed clones can fast-forward — history is never rewritten; skipped with a warning until PLUGIN_DIST_TOKEN is configured). The dist repo's tree root is the package, enabling the root install shorthand hermes plugins install iap/pstack --enable — no subdir — and in-place hermes plugins update pstack (root installs keep .git; verified against the hermes installer source). Requires the one-time PLUGIN_DIST_TOKEN secret (fine-grained PAT, contents: read/write on the dist repo only).
• Agent-facing docs: AGENTS.md (harness identity, generated-tree rule, hermes-vs-Cursor vocabulary, primitive mapping) and a CONTRIBUTING rewrite (orientation, Bun setup, common-task recipes, publish stage).
• docs/USING.md "Customizing skills": the three-route guidance (edit in place, fork the dist repo, skill tap) with the keep-hermes-vocabulary warning for end users.

Changed

• README install routes reorganized: root install via the dist repo is primary; the iap/pstack-hermes/pstack subdir install is documented as the legacy route (still works). Update instructions split by route (in-place update for root installs; reinstall for subdir installs).

Fixed

• Converter: T13_MAP's frontier-provider entry was anchored on text that only exists after the T13_MAP forge-wording entry and T14_MAP's first entry run — an ordering that can never match a clean pinned clone (the local 2026-09-14 build predated the map edit and its pstack/ was stale). Re-anchored the entry to the pinned paragraph, pruned the two subsumed entries (T13_MAP forge-wording line, T14_MAP first entry — their intent is carried by the full-paragraph provider-selection rewrite), and rebuilt from the clean pin: orchestrate.md and the package README now carry the T15 provider-selection wording, with the anchor audit passing against a fresh clone of 93b00b8.
• T15b robustness (carried through the converter after a direct-to-generated-file edit was caught by the reproducibility gate): GitHub-native discovery now scopes itself to an explicit --prs pin instead of validating every PR in the repository as one stack, gh pr list passes an explicit --limit 100 so connected stacks beyond 30 PRs are not silently truncated, and auto-provider fallback is persisted into frontier.json as a fallback field (which providers were skipped) so a Graphite → GitHub fallback is coordinator-visible instead of silent. The GitLab provider remains reserved ("not implemented yet") pending a reviewed glab integration.