Sync specs with contributed functionality

[potiuk]

Summary

• Brings tools/spec-loop/specs/ back in line with everything merged to main since the last sync marker.
  The previous marker (bcd8b7f2) was 65 commits behind main, up to and including perf(security): write rollups and body fields without loading them into context #1451.
  tools/spec-loop/.last-sync now points at da660f14.
• This is specs only: 33 spec files plus the marker.
  No skill, tool, or doc outside tools/spec-loop/specs/ changes.
• The main themes:
  • Skills moved into per-family plugin directories, and the project templates moved into the magpie-setup plugin.
  • New contributor-growth skills and tools: calibrate, candidate-screen, identity-map, contributor-metrics, and contract:chat.
  • The adversarial-review rollout.
  • The read-only GitLab bridge.
  • The github-rollup subcommands, and the vetted-op-tracker entry point that the security skills now write through (feat(vetted-ops): tracker rollup and body-field writes through a sandbox-exempt entry point #1448, perf(security): write rollups and body fields without loading them into context #1451).
  • The security-family split, fixes, fetch-once-per-run batching, and pre-flight no-op skips (perf(security): drop the Snapshot drift sections the pre-flight check already covers #1435–perf(security): skip obvious no-ops before any per-item model work #1449).
  • The Vulnogram token flow.
  • Setup and sandbox changes: gh api asks only on writes, the read-only allow set ships to adopters, commit attribution is a project choice, and working-directory grants.
  • Per-skill token stamps.
  • Along the way, stale paths, counts, statuses, and known gaps are corrected.

Type of change

• Documentation (docs/, README.md, CONTRIBUTING.md)
• Other: spec-loop specs and sync marker

Test plan

• prek run --all-files passes
• Every claim was checked against the code on main at da660f14, not inferred from commit messages alone.
  Where a commit message and the code disagreed, the spec follows the code.
  Example: after feat(vetted-ops): tracker rollup and body-field writes through a sandbox-exempt entry point #1448 the security skills did not yet call vetted-op-tracker, so the spec recorded a gap until perf(security): write rollups and body fields without loading them into context #1451 closed it.

RFC-AI-0004 compliance

Not applicable; this documents shipped behaviour and changes no behaviour.

Notes for reviewers (optional)

The sync surfaced defects in code and docs outside the spec directory.
They are recorded as Known gaps in the relevant specs where they apply, and are left for follow-up PRs:

• reviewer-routing tells users to run privacy-llm-check --list; the checker has no --list flag.
• .apache-magpie-overrides/release-management-config.md (from config: publish Magpie's project configuration and AI contribution policy #1412) is the unfilled Apache Foo template.
  Per-file resolution makes it shadow Magpie's real ATR config in projects/magpie/.
• tools/github/status-rollup.md still shows only the uv run … github-rollup CLI, not vetted-op-tracker.
• tools/gitlab/tool.md still describes the ceil(limit / 100) paging that fix(tools/gitlab): address review follow-up on pagination docstring, short pages, and issue template #1441 replaced.
• The isolated-setup-doctor and isolated-setup-verify headings say 8 probes and 12 checks; there are 9 and 15.
• contributor-identity-map, onboarding-concierge, and sentiment do not declare organization: ASF.
• docs/contributor-growth/README.md lists committer-onboarding as Triage (its mode is Meta) and gives two different skill counts.
• tools/cve-tool-vulnogram/oauth-api docstrings still name a real CVE ID and another project's product names.

Suggested labels: family:docs, family:tools.

---

Generative AI tooling was used to author this PR: Claude Code (Claude Opus 5).

🤖 Generated with Claude Code