fix: Windows file identity handling and security vulnerabilities (#225)

* fix(native): handle Windows file identity metadata

* fix(deps): patch brace-expansion vulnerability

* fix(security): resolve CodeQL findings

docs: remove unless

docs: remove unless file

fix: write hooks to hooks.json (#201)

* docs: design Codex hook path migration

* docs: plan Codex hook path migration

* fix(codex): route hooks to hooks.json

* fix(codex): migrate hook configuration

* fix(codex): preserve migrated hook groups

* fix(codex): clean legacy hook files

* fix(codex): isolate hook cleanup failures

* docs: record Codex hook path fix

* chore: bump version to 0.4.0-beta.5

* fix(codex): harden hook migration

* docs: format Codex hook migration plan

* docs: remove implementation planning files

* docs: design standard Superpowers artifact routing

* docs: add standard artifact routing plan

* fix: drive comet-open from OpenSpec status

* fix(classic): allow standard Superpowers artifact writes

* fix(classic): harden Superpowers artifact slot routing

* docs: document standard Superpowers artifact routing

* fix(classic): close Superpowers artifact routing bypasses

* test(classic): validate migration guard outcomes

* docs: remove unless file

* fix(codex): isolate malformed legacy hook configs

* fix(codex): make legacy hook cleanup best effort

* refactor(skill): align hook cleanup test ownership

* docs: design Skill Hook Rule lifecycle hardening

* docs: plan Skill Hook Rule lifecycle hardening

* docs: refine lifecycle inspection boundaries

* fix(skill): fail closed on invalid Hook configuration

* fix(skill): harden Hook failure boundaries

* fix(skill): propagate Rule and removal failures

* fix(skill): surface lifecycle inspection failures

* fix(skill): preserve legacy and Kiro Hook boundaries

* docs: align lifecycle plan with runtime sync

* fix(skill): surface incomplete Comet lifecycle updates

* fix(skill): preserve lifecycle target failure details

* feat(doctor): detect incomplete Rule and Hook installs

* fix(doctor): deduplicate shared Skill roots

* docs: document Skill lifecycle integrity fixes

* fix(skill): harden lifecycle ownership and cleanup

* fix(skill): complete lifecycle recovery safeguards

* fix(skill): retry registered platform cleanup

* fix(skill): merge detected and recovery cleanup targets

* fix: tighten comet workflow guardrails

* test: update classic contract projection

* docs: define native workflow design

* docs: bump website submodule for eval skill-path-first docs

Updates the website submodule to the eval docs restructure that leads with the skill-path entry (comet eval ./my-skill) and repositions comet/eval.yaml as the advanced /comet-any full-package path and publish-evidence flow. See the submodule commit for the full change list.

* docs: update website submodule pointer after rebase

fix: prune excluded publish paths before scanning

fix: harden classic runtime distribution (#169)

* fix: harden classic runtime distribution

* fix: stabilize classic runtime validation output

* docs: sync website doctor scope docs

* fix: handle removed classic command fields

* fix(classic): error on malformed .comet/config.yaml instead of silent skip

removedProjectCommandField returned false when .comet/config.yaml had a
YAML parse error, so an upgraded project could still declare a removed
build_command/verify_command and silently fall through to the inferred
build check. Throw a clear parse error instead -- both call sites run
inside check() wrappers, so it becomes a FAIL outcome that blocks the
guard, matching how readField already treats invalid .comet.yaml.

fix: stabilize npm publish checks

docs: update readme

docs(release): update release notes and README for 0.3.8 and 0.3.9

chore(deps): add husky and lint-staged to devDependencies

- Added husky version 9.1.7 for Git hooks management
- Added lint-staged version 17.0.7 for running linters on staged files
- Updated package-lock.json with new dependencies and their transitive dependencies
- Included ancillary packages required by husky and lint-staged for functionality and compatibility
- Ensured node engine version requirements are met for the new dependencies
- Registered funding URLs for new packages to support maintainers