Simplify packaging (uv) + architecture; fix cost-report cache cost; add credential & precompact hooks

[verkligheten]

Summary

Simplifies agent-notes' packaging and architecture (the "Option A" direction — stay in Python, fix the real pain points) and lands three approved functional improvements. Every refactor is behavior-preserving: agent-notes build output stays byte-identical and the full suite is green at each step.

Test status: 1810 passed (was 1579 at branch point — +231 new tests), generated dist/ byte-identical to develop.

Packaging — kills the venv friction

• Adopt uv ([dependency-groups] + uv.lock); de-venv scripts/release to uv-first with a .venv fallback; CI → astral-sh/setup-uv.
• Lazy-import tomli_w so it's no longer needed at CLI startup for unrelated commands.

Architecture — phased, behavior-preserving

• FrontmatterBase — shared strip_sections/COLOR_TO_HEX extracted from the 3 generators.
• MemoryBackend ABC — polymorphic router dispatch replaces string if/elif; clean 4th-backend extension point.
• ModelResolver — the scattered ~17-hop model-resolution chain consolidated into one object (+20 characterization tests). Surfaced that Role.default_model is dead data (declared in YAML, never read).
• Split installer.py — 587 → 291 LOC, extracted install_plan.py + install_executor.py; added build→install→doctor round-trip integration tests.

Functional

• fix(cost-report): price cache writes separately from reads — collects cache_creation (5m/1h) tokens and prices read 0.1× / write-5m 1.25× / write-1h 2× of input. Previously cache writes were invisible; real transcripts use the 1h TTL, so spend was materially understated.
• feat(hooks): PreToolUse credential-guard — deterministic enforcement of the credential rule (deny reads of secret files via Read/Bash/Grep). Two rounds of adversarial security review; deny-by-default Bash scanning (two-pass shlex+regex), word-boundary keyword matching, .env.example allowed, fail-closed for recognized tools.
• feat(hooks): PreCompact memory re-emit — re-injects the memory index before compaction so the durable-memory pointer survives (obsidian/wiki backends).

Roles, install/uninstall assurance, and docs (follow-up)

• refactor(roles): drop default_model — the field was only read by the wizard (never by resolution). Removed it; the wizard now selects the newest non-deprecated model of a role's class. This also wired up Model.deprecated (the flag was in the YAML but never loaded), so the wizard no longer offers deprecated models. reasoner still resolves to claude-opus-4-8; generated output unchanged.
• test(install): end-to-end coverage — added a real (un-mocked) uninstall test proving every hook / permissions.allow entry / state scope / component / context file is removed while user keys and intentionally-kept vault permissions survive; plus a full-wizard happy-path test.
• docs(readme): Uninstall + Upgrade sections — added a dedicated Uninstall section (pipx + venv, with correct ordering and an accurate permissions.allow vault-permission note), an "Upgrade from a previous version" subsection (update-in-place vs clean reinstall one-liners), and a note that uv is dev/release-only (end-user install stays pipx/venv).

Deferred / out of scope

• G3 (subagent primitives — fallbackModel / worktree isolation / fork mode): intentionally skipped; isolation: worktree default-on would change the direct-edit workflow.
• Candidate follow-ups: remove/wire the dead Role.default_model; consider a node_modules path-allowlist for the credential guard.
• Note: once merged, scripts/release is uv-first (no longer pinned to .venv).