gstack 1.65.0.0

And every consent gate now means what it says.

This is the second and final wave of the GStack 2 fork port. Wave one (v1.63.0.0) took the audit infrastructure; this wave takes the fixes and the features. Three skills that failed silently on every run now work: /autoplan's task aggregation emits real tasks instead of zero, /codex creates its temp files on macOS instead of dying on BSD mktemp, and memory ingest actually imports pages on current gbrain builds, and prints the count so you can see it. On top of that: your browser auth can now survive a daemon restart, /ship can take an iOS app from working tree to Submit for Review, and four supply-chain gates now run on every PR. Nearly all of it traces back to Sina Matian's time-attack/gstack fork, ported with tests and attribution.

Added: Opt-in browser session persistence (#778, #2193): BROWSE_PERSIST_STATE=1 snapshots cookies and tabs (atomic writes, 0600, never page HTML or ownership), restores them off the boot path on the next start, and quarantines a corrupt snapshot instead of crashing. Portions from time-attack/gstack. Apple App Store release journey for /ship: ship/sections/apple-release.md loads before the repo-landing gates when the target is an Apple app. Encodes session-minted App Store Connect keys, appPriceSchedules over the broken fastlane price_tier, expanded age-rating attributes, -22938 classification, and a one-authorization-moment flow. Refined across 21 live releases on the fork. Portions copyright Sina Matian, MIT. Code-intelligence provider contract, Phase 1: gstack-code-intelligence wraps GBrain, Sourcebot, and Graphify behind one interface with an ask-once indexing offer for large repos (1,000+ tracked files, decline persisted). Consent is explicit per repo (consent yes|no), the per-repo trust policy's deny and read-only tiers veto write-class operations no matter what consent was recorded, and every off-machine send writes an egress receipt that records the consent state actually checked. Portions from time-attack/gstack. Supply-chain CI: a quality gate that runs bin/gstack-redact over every PR diff (HIGH findings fail, MEDIUM annotates), dependency review on lockfile changes, weekly OSV scans, grouped dependabot updates, and an evidence-bar PR template. Every third-party action in the new workflows is pinned to a commit SHA. Third-party web-actions contract in tier-2+ skills: when a workflow needs a vendor-site step (API key signup, OAuth app), gstack offers to drive the browser itself, hands credentials and CAPTCHAs to you, stores secrets owner-only, and verifies with a read-only call before claiming success. Design docs land in your repo (#703, #2000): office-hours writes docs/designs/ .md as a concise decision record (one bullet per decision with its why), redaction-scanned before anything touches your git history. Plan reviews prefer the repo-local doc when both exist. gstack-verify-gate (opt-in Stop hook): blocks turn-end until the CLAUDE.md-declared verify command passes. A command runs only after you trust it once per repo (--trust), re-trust is required when it changes, every grant is audit-logged, and re-entries re-run the check instead of waving it through. Never show me these again for the founder-resources pitch (#538): the opt-out verifies its own config write before promising anything. Re-enable with gstack-config set founder_resources true. Claimed limitations need evidence: every tier-2+ skill now treats the API can't do this as a material claim requiring the verbatim error, the documented statement, or a live probe, and runs the ten-second check before declaring anything blocked.

Fixed: /autoplan Phase 4 emitted zero tasks on every run (#2018): a jq context rebind dropped every aggregated task; the error was hidden by stderr suppression. Six-fixture regression suite pins it. /codex was broken on every macOS install (#2091): BSD mktemp rejects suffixed templates; all temp files now use portable templates and a static test bans the p