- Replace silent `find -execdir uv sync` in the Install uv package
manager step with an error propagating while loop.

- Adds -type f flag for parity with on-create.sh, uses -print0/read -d
'' for safe path handling, emits ::error:: annotations per failing
directory, processes all skills before aborting, and exits non-zero if
any sync fails.
 
## Related Issue(s)

Closes #946

## Type of Change

Select all that apply:

**Code & Documentation:**

* [x] Bug fix (non-breaking change fixing an issue)
* [ ] New feature (non-breaking change adding functionality)
* [ ] Breaking change (fix or feature causing existing functionality to
change)
* [ ] Documentation update

**Infrastructure & Configuration:**

* [x] GitHub Actions workflow
* [ ] Linting configuration (markdown, PowerShell, etc.)
* [ ] Security configuration
* [ ] DevContainer configuration
* [ ] Dependency update

**Other:**

* [ ] Script/automation (`.ps1`, `.sh`, `.py`)
* [ ] Other (please describe):

## Testing

Ran workflow in forked repository in `main` -- producing the following
output for the relevant step:

```
Syncing Python environments for skills...
Installing dependencies in .github/skills/experimental/powerpoint
Using CPython 3.11.14 interpreter at: /opt/hostedtoolcache/Python/3.11.14/x64/bin/python3
Creating virtual environment at: .venv
Resolved 33 packages in 0.61ms
Downloading pygments (1.2MiB)
Downloading pymupdf (23.8MiB)
Downloading lxml (5.0MiB)
Downloading pillow (6.7MiB)
Downloading ruff (10.7MiB)
Downloading github-copilot-sdk (56.5MiB)
Downloading pydantic-core (2.0MiB)
 Downloaded pydantic-core
 Downloaded ruff
 Downloaded pillow
 Downloaded lxml
 Downloaded pygments
 Downloaded pymupdf
 Downloaded github-copilot-sdk
Prepared 30 packages in 1.73s
Installed 30 packages in 24ms
 + annotated-types==0.7.0
 + cairocffi==1.7.1
 + cairosvg==2.8.2
 + cffi==2.0.0
 + coverage==7.13.4
 + cssselect2==0.9.0
 + defusedxml==0.7.1
 + github-copilot-sdk==0.1.30
 + iniconfig==2.3.0
 + lxml==6.0.2
 + packaging==26.0
 + pillow==12.1.1
 + pluggy==1.6.0
 + pycparser==3.0
 + pydantic==2.12.5
 + pydantic-core==2.41.5
 + pygments==2.19.2
 + pymupdf==1.27.1
 + pytest==9.0.2
 + pytest-cov==7.0.0
 + python-dateutil==2.9.0.post0
 + python-pptx==1.0.2
 + pyyaml==6.0.3
 + ruff==0.15.4
 + six==1.17.0
 + tinycss2==1.5.1
 + typing-extensions==4.15.0
 + typing-inspection==0.4.2
 + webencodings==0.5.1
 + xlsxwriter==3.2.9
```

## Checklist

### Required Checks

* [ ] Documentation is updated (if applicable)
* [x] Files follow existing naming conventions
* [ ] Changes are backwards compatible (if applicable)
* [ ] Tests added for new functionality (if applicable)

### Required Automated Checks

The following validation commands must pass before merging:

* [x] Markdown linting: `npm run lint:md`
* [x] Spell checking: `npm run spell-check`
* [x] Frontmatter validation: `npm run lint:frontmatter`
* [x] Skill structure validation: `npm run validate:skills`
* [x] Link validation: `npm run lint:md-links`
* [x] PowerShell analysis: `npm run lint:ps`
* [x] Plugin freshness: `npm run plugin:generate`
* [ ] YAML linting: `npm run lint:yaml`

## Security Considerations
<!-- ⚠️ WARNING: Do not commit sensitive information such as API keys,
passwords, or personal data -->
* [x] This PR does not contain any sensitive or NDA information
* [ ] Any new dependencies have been reviewed for security issues
* [ ] Security-related scripts follow the principle of least privilege

## Additional Notes

The same `-type f` parity and error-propagation improvements could be
applied here in a follow-on task.

- Bold suggestion titles in numbered list for visual prominence
- Add blockquote mapping each button (1️⃣ 2️⃣ 3️⃣) to its suggestion
title

## Related Issue(s)
Closes #495

## Type of Change

Select all that apply:

**Code & Documentation:**

* [x] Bug fix (non-breaking change fixing an issue)
* [ ] New feature (non-breaking change adding functionality)
* [ ] Breaking change (fix or feature causing existing functionality to
change)
* [ ] Documentation update

**Infrastructure & Configuration:**

* [ ] GitHub Actions workflow
* [ ] Linting configuration (markdown, PowerShell, etc.)
* [ ] Security configuration
* [ ] DevContainer configuration
* [ ] Dependency update

**AI Artifacts:**

* [ ] Reviewed contribution with `prompt-builder` agent and addressed
all feedback
* [ ] Copilot instructions (`.github/instructions/*.instructions.md`)
* [ ] Copilot prompt (`.github/prompts/*.prompt.md`)
* [ ] Copilot agent (`.github/agents/*.agent.md`)
* [ ] Copilot skill (`.github/skills/*/SKILL.md`)

> Note for AI Artifact Contributors:
>
> * Agents: Research, indexing/referencing other project (using standard
VS Code GitHub Copilot/MCP tools), planning, and general implementation
agents likely already exist. Review `.github/agents/` before creating
new ones.
> * Skills: Must include both bash and PowerShell scripts. See
[Skills](../docs/contributing/skills.md).
> * Model Versions: Only contributions targeting the **latest Anthropic
and OpenAI models** will be accepted. Older model versions (e.g.,
GPT-3.5, Claude 3) will be rejected.
> * See [Agents Not
Accepted](../docs/contributing/custom-agents.md#agents-not-accepted) and
[Model Version
Requirements](../docs/contributing/ai-artifacts-common.md#model-version-requirements).

**Other:**

* [ ] Script/automation (`.ps1`, `.sh`, `.py`)
* [ ] Other (please describe):

## Sample Prompts (for AI Artifact Contributions)

<!-- If you checked any boxes under "AI Artifacts" above, provide a
sample prompt showing how to use your contribution -->
<!-- Delete this section if not applicable -->

**User Request:**
<!-- What natural language request would trigger this
agent/prompt/instruction? -->

**Execution Flow:**
<!-- Step-by-step: what happens when invoked? Include tool usage,
decision points -->

**Output Artifacts:**
<!-- What files/content are created? Show first 10-20 lines as preview
-->

**Success Indicators:**
<!-- How does user know it worked correctly? What validation should they
perform? -->

For detailed contribution requirements, see:

* Common Standards:
[docs/contributing/ai-artifacts-common.md](../docs/contributing/ai-artifacts-common.md)
- Shared standards for XML blocks, markdown quality, RFC 2119,
validation, and testing
* Agents:
[docs/contributing/custom-agents.md](../docs/contributing/custom-agents.md)
- Agent configurations with tools and behavior patterns
* Prompts:
[docs/contributing/prompts.md](../docs/contributing/prompts.md) -
Workflow-specific guidance with template variables
* Instructions:
[docs/contributing/instructions.md](../docs/contributing/instructions.md)
- Technology-specific standards with glob patterns
* Skills: [docs/contributing/skills.md](../docs/contributing/skills.md)
- Task execution utilities with cross-platform scripts

## Testing
<!-- Describe how you tested these changes -->

## Checklist

### Required Checks

* [x] Documentation is updated (if applicable)
* [x]  Files follow existing naming conventions
* [ ] Changes are backwards compatible (if applicable)
* [ ] Tests added for new functionality (if applicable)

### AI Artifact Contributions
<!-- If contributing an agent, prompt, instruction, or skill, complete
these checks -->
* [ ] Used `/prompt-analyze` to review contribution
* [ ] Addressed all feedback from `prompt-builder` review
* [ ] Verified contribution follows common standards and type-specific
requirements

### Required Automated Checks

The following validation commands must pass before merging:

* [ ] Markdown linting: `npm run lint:md`
* [ ] Spell checking: `npm run spell-check`
* [ ] Frontmatter validation: `npm run lint:frontmatter`
* [ ] Skill structure validation: `npm run validate:skills`
* [ ] Link validation: `npm run lint:md-links`
* [ ] PowerShell analysis: `npm run lint:ps`
* [ ] Plugin freshness: `npm run plugin:generate`

## Security Considerations
<!-- ⚠️ WARNING: Do not commit sensitive information such as API keys,
passwords, or personal data -->
* [ ] This PR does not contain any sensitive or NDA information
* [ ] Any new dependencies have been reviewed for security issues
* [ ] Security-related scripts follow the principle of least privilege

## Additional Notes
<!-- Any additional information that reviewers should know -->

---------

Co-authored-by: Katrien De Graeve <katriendg@users.noreply.github.com>

Added declarative GitHub label management to the repository.
*`.github/labels.yml`* defines all 62 live repository labels as code —
60 canonical entries organized into five comment-annotated groups (Type,
Area, Priority, Status/Process, and Release Management), with aliases on
the `instructions` and `prompts` labels consolidating the legacy
`instruction-file` and `prompt` labels respectively.
*`.github/workflows/label-sync.yml`* syncs labels additively using
**EndBug/label-sync v2.3.3**, triggered on push to `main` when either
file changes and on `workflow_dispatch`.

> Labels are synced in additive mode (`delete-other-labels: false`),
which means no existing label is deleted until the file is the
authoritative source. The alias entries migrate existing issue and PR
assignments from the legacy labels to their canonical counterparts on
first sync run.

Both action references are SHA-pinned to full 40-character commit SHAs
per repository convention.

## Related Issue(s)

Closes #518

## Type of Change

Select all that apply:

**Code & Documentation:**

* [ ] Bug fix (non-breaking change fixing an issue)
* [x] New feature (non-breaking change adding functionality)
* [ ] Breaking change (fix or feature causing existing functionality to
change)
* [ ] Documentation update

**Infrastructure & Configuration:**

* [x] GitHub Actions workflow
* [ ] Linting configuration (markdown, PowerShell, etc.)
* [ ] Security configuration
* [ ] DevContainer configuration
* [ ] Dependency update

**Other:**

* [ ] Script/automation (`.ps1`, `.sh`, `.py`)
* [ ] Other (please describe):

## Testing

Ran the workflow on the forked repository after merging to main

### Workflow output:

```
Run EndBug/label-sync@5207415

Checking inputs...
  🛈 Current config mode: local
  ✓ Inputs are valid
.github/labels.yml

Reading config file...
  🛈 Reading file...
  🛈 Parsing YAML file...
  ✓ File parsed successfully.
  🛈 Parsed config:
  [
    {
      "name": "bug",
      "color": "d73a4a",
      "description": "Something isn't working"
    },
    {
      "name": "breaking-change",
      "color": "B60205",
      "description": "Breaking change requiring major version bump"
    },
    
    ...

    (Remaining labels)
  ]

Syncing labels...
  ✓ Sync successful

Label diff
  
  feature [missing]
  ☀️  → feature
  ☀️  → #1D76DB
  ☀️  → New feature triggering minor version bump
  
  maintenance [missing]
  ☀️  → maintenance
  ☀️  → #FBCA04
  ☀️  → Maintenance work, no version bump
  
  refactor [missing]
  ☀️  → refactor
  ☀️  → #ededed
  ☀️  → Code refactoring without functional changes
  
  performance [missing]
  ☀️  → performance
  ☀️  → #0E8A16
  ☀️  → Performance improvement
  
  security [missing]
  ☀️  → security
  ☀️  → #D93F0B
  ☀️  → Security improvement or fix
```

## Checklist

### Required Checks

* [ ] Documentation is updated (if applicable)
* [x] Files follow existing naming conventions
* [x] Changes are backwards compatible (if applicable)
* [ ] Tests added for new functionality (if applicable)

### AI Artifact Contributions
<!-- If contributing an agent, prompt, instruction, or skill, complete
these checks -->
* [ ] Used `/prompt-analyze` to review contribution
* [ ] Addressed all feedback from `prompt-builder` review
* [ ] Verified contribution follows common standards and type-specific
requirements

### Required Automated Checks

The following validation commands must pass before merging:

* [x] Markdown linting: `npm run lint:md`
* [ ] Spell checking: `npm run spell-check` (N/A — no prose markdown
files changed)
* [ ] Frontmatter validation: `npm run lint:frontmatter` (N/A — no
instruction, prompt, or agent files changed)
* [ ] Skill structure validation: `npm run validate:skills` (N/A — no
skill files changed)
* [ ] Link validation: `npm run lint:md-links` (N/A — no markdown files
changed)
* [ ] PowerShell analysis: `npm run lint:ps` (N/A — no PowerShell files
changed)
* [ ] Plugin freshness: `npm run plugin:generate` (N/A — no collection
files changed)

## Security Considerations
<!-- ⚠️ WARNING: Do not commit sensitive information such as API keys,
passwords, or personal data -->
* [x] This PR does not contain any sensitive or NDA information
* [x] Any new dependencies have been reviewed for security issues
* [x] Security-related scripts follow the principle of least privilege

## Additional Notes

The workflow uses `GITHUB_TOKEN` — no new secrets are required. The
token is already available in all Actions runs.

Two additional workflow-level validations were confirmed:

* **SHA pinning**: Both
`actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.2.2` and
`EndBug/label-sync@52074158190acb45f3077f9099fea818aa43f97a # v2.3.3`
are pinned to full 40-character commit SHAs with version comments.
* **Permissions**: `contents: read` declared at workflow level; `issues:
write` granted only at job level, following the principle of least
privilege.

# feat(workflows): add ms.date documentation freshness checking

## Description

This PR ports the automated `ms.date` documentation freshness checking
system from
[`Azure-Samples/azure-nvidia-robotics-reference-architecture`](https://github.com/Azure-Samples/azure-nvidia-robotics-reference-architecture)
PR #448 into hve-core. The system tracks the `ms.date` frontmatter field
across all markdown files, surfaces stale content through CI annotations
during pull requests, and automates GitHub issue creation for stale
files on a weekly schedule.

### PowerShell Script and Tests

The core of the feature is *Invoke-MsDateFreshnessCheck.ps1*, a
PowerShell 7 script that discovers markdown files, parses `ms.date` from
YAML frontmatter, computes staleness against a configurable day
threshold, and generates both a JSON report
(`logs/msdate-freshness-results.json`) and a markdown summary
(`logs/msdate-summary.md`). Stale files emit CI annotations via the
existing `Write-CIAnnotation` helper.

- Added `scripts/linting/Invoke-MsDateFreshnessCheck.ps1` — file
discovery with configurable exclusions (`node_modules`, `.git`, `logs`,
`.copilot-tracking`, `CHANGELOG.md`), YAML frontmatter parsing via
`powershell-yaml`, and `changed-files-only` mode backed by `git diff`
- Fixed a bug present in the source repo: `$isExplicitFilePath` now uses
`Test-Path -PathType Leaf` rather than `$path -ne '.'`, ensuring
absolute directory paths correctly receive exclusion filtering
- Added `scripts/tests/linting/Invoke-MsDateFreshnessCheck.Tests.ps1` —
Pester 5 test suite (~530 lines) with `Unit` and `Integration` tags,
covering file discovery (6 contexts), frontmatter parsing (5 contexts
including YAML errors and file-not-found), report generation (4
contexts), and an integration loop exercising `Write-CIAnnotation` via a
verifiable mock
- Added `msdate` to `.cspell/general-technical.txt`

### GitHub Actions Workflows

Three new reusable workflows implement the dual-context checking
pattern:

- Added `.github/workflows/msdate-freshness-check.yml` — reusable
`workflow_call` with `staleness-threshold-days` (default: 90) and
`changed-files-only` inputs; uploads `msdate-freshness-results.json` as
a workflow artifact and writes the markdown summary to the Actions job
summary
- Added `.github/workflows/weekly-validation.yml` — scheduled
orchestrator running Monday at 09:00 UTC; calls
`msdate-freshness-check.yml` for a full-repository scan, then calls
`create-stale-docs-issues.yml`
- Added `.github/workflows/create-stale-docs-issues.yml` — idempotent
issue automation; uses a hidden `<!-- automation:stale-docs:{file-path}
-->` marker to locate existing open issues before creating new ones,
avoiding duplicates across weekly runs

Modified `.github/workflows/pr-validation.yml` to add the
`msdate-freshness` job between `frontmatter-validation` and
`plugin-validation`, running with `changed-files-only: true` against
files changed in the PR.

### Documentation

Added `docs/contributing/documentation-maintenance.md` explaining the
dual-context freshness pattern, how to fix stale documentation, how to
configure thresholds, how the issue automation deduplicates, and common
troubleshooting steps. Stale `soft-fail` references were also removed
from the guide during review — the implementation is a hard-fail; there
is no `soft-fail` mode.

## Related Issue(s)

Closes #968

## Type of Change

Select all that apply:

**Code & Documentation:**

* [ ] Bug fix (non-breaking change fixing an issue)
* [x] New feature (non-breaking change adding functionality)
* [ ] Breaking change (fix or feature causing existing functionality to
change)
* [x] Documentation update

**Infrastructure & Configuration:**

* [x] GitHub Actions workflow
* [ ] Linting configuration (markdown, PowerShell, etc.)
* [ ] Security configuration
* [ ] DevContainer configuration
* [ ] Dependency update

**AI Artifacts:**

* [ ] Reviewed contribution with `prompt-builder` agent and addressed
all feedback
* [ ] Copilot instructions (`.github/instructions/*.instructions.md`)
* [ ] Copilot prompt (`.github/prompts/*.prompt.md`)
* [ ] Copilot agent (`.github/agents/*.agent.md`)
* [ ] Copilot skill (`.github/skills/*/SKILL.md`)

> Note for AI Artifact Contributors:
>
> * Agents: Research, indexing/referencing other project (using standard
VS Code GitHub Copilot/MCP tools), planning, and general implementation
agents likely already exist. Review `.github/agents/` before creating
new ones.
> * Skills: Must include both bash and PowerShell scripts. See
[Skills](../docs/contributing/skills.md).
> * Model Versions: Only contributions targeting the **latest Anthropic
and OpenAI models** will be accepted. Older model versions (e.g.,
GPT-3.5, Claude 3) will be rejected.
> * See [Agents Not
Accepted](../docs/contributing/custom-agents.md#agents-not-accepted) and
[Model Version
Requirements](../docs/contributing/ai-artifacts-common.md#model-version-requirements).

**Other:**

* [x] Script/automation (`.ps1`, `.sh`, `.py`)
* [ ] Other (please describe):

## Sample Prompts (for AI Artifact Contributions)

<!-- If you checked any boxes under "AI Artifacts" above, provide a
sample prompt showing how to use your contribution -->
<!-- Delete this section if not applicable -->

## Testing

Validated using the Pester 5 test suite added as part of this PR:

- `npm run test:ps` — 1691 tests passed (0 failures); includes all
existing tests plus the new `Invoke-MsDateFreshnessCheck.Tests.ps1`
suite covering `Get-MarkdownFiles`, `Get-MsDateFromFrontmatter`,
`New-MsDateReport`, and integration contexts
- `npm run lint:ps` — PSScriptAnalyzer reported no issues against
`Invoke-MsDateFreshnessCheck.ps1`
- `npm run lint:frontmatter` — 0 errors, 0 warnings across all markdown
files including the new `documentation-maintenance.md`
- `npm run validate:skills` — 5 skills validated, 0 errors
- `npm run plugin:generate` — 11 plugins generated successfully

Manual verification: Reviewed all workflow files for SHA-pinned actions,
least-privilege permissions, and consistent `shell: pwsh` per-step (no
workflow-level `defaults`).

## Checklist

### Required Checks

* [x] Documentation is updated (if applicable)
* [x] Files follow existing naming conventions
* [x] Changes are backwards compatible (if applicable)
* [x] Tests added for new functionality (if applicable)

### AI Artifact Contributions

<!-- If contributing an agent, prompt, instruction, or skill, complete
these checks -->

* [ ] Used `/prompt-analyze` to review contribution (N/A — no AI
artifact changes)
* [ ] Addressed all feedback from `prompt-builder` review (N/A — no AI
artifact changes)
* [ ] Verified contribution follows common standards and type-specific
requirements (N/A — no AI artifact changes)

### Required Automated Checks

The following validation commands must pass before merging:

* [ ] Markdown linting: `npm run lint:md` (not available in local
environment; runs in CI)
* [ ] Spell checking: `npm run spell-check` (not available in local
environment; runs in CI)
* [x] Frontmatter validation: `npm run lint:frontmatter`
* [x] Skill structure validation: `npm run validate:skills`
* [ ] Link validation: `npm run lint:md-links` (not available in local
environment; runs in CI)
* [x] PowerShell analysis: `npm run lint:ps`
* [x] Plugin freshness: `npm run plugin:generate`

## Security Considerations

<!-- ⚠️ WARNING: Do not commit sensitive information such as API keys,
passwords, or personal data -->

* [x] This PR does not contain any sensitive or NDA information
* [x] Any new dependencies have been reviewed for security issues
* [ ] Security-related scripts follow the principle of least privilege
(N/A — no security scripts modified)

## Additional Notes

- GitHub labels `stale-docs` and `automated` must be created in the
repository before `create-stale-docs-issues.yml` runs in production. No
automated pre-flight check exists — this is an operational prerequisite.
- `create-stale-docs-issues.yml` rewrites the full issue body on each
weekly run. Human edits to the issue body will be discarded; comments
are preserved.
- `PowerShell-Yaml` is installed on each run without a version pin or
module cache. Pinning the version is a follow-up improvement.
- The artifact name `msdate-freshness-results` is hardcoded in the
producer workflow and referenced by name in the consumer. This loose
coupling is intentional but worth noting for future maintainers.

…980)

Rename the `security-planning` collection to `security` to broaden scope
from planning-only to the full security domain (review, planning,
incident response, risk assessment, vulnerability analysis).

**Changes:**

- Rename collection ID from `security-planning` to `security`
- Broaden scope from planning-only to full security domain
- Set collection maturity to `experimental`
- Move `.github/agents/security-planning/` to `.github/agents/security/`
- Move `.github/prompts/security-planning/` to
`.github/prompts/security/`
- Update `hve-core-all.collection.yml`, `.vscode/settings.json`,
installer skill, prompts README, and 14 documentation files
- Regenerate `plugins/security/` via `plugin:generate`

**BREAKING CHANGE:** collection ID changed from `security-planning` to
`security`

## Related Issue(s)

Closes #792

## Type of Change

Select all that apply:

**Code & Documentation:**

* [ ] Bug fix (non-breaking change fixing an issue)
* [ ] New feature (non-breaking change adding functionality)
* [x] Breaking change (fix or feature causing existing functionality to
change)
* [x] Documentation update

**Infrastructure & Configuration:**

* [ ] GitHub Actions workflow
* [ ] Linting configuration (markdown, PowerShell, etc.)
* [ ] Security configuration
* [ ] DevContainer configuration
* [ ] Dependency update

**AI Artifacts:**

* [ ] Reviewed contribution with `prompt-builder` agent and addressed
all feedback
* [ ] Copilot instructions (`.github/instructions/*.instructions.md`)
* [ ] Copilot prompt (`.github/prompts/*.prompt.md`)
* [ ] Copilot agent (`.github/agents/*.agent.md`)
* [ ] Copilot skill (`.github/skills/*/SKILL.md`)

**Other:**

* [ ] Script/automation (`.ps1`, `.sh`, `.py`)
* [ ] Other (please describe):

## Testing

- `npm run plugin:generate` — produces `plugins/security/` with 4 items
- `npm run plugin:validate` — 11 collections validated, 0 errors
- `npm run lint:all` — passes (only pre-existing `VersionMismatch` in
`codeql-analysis.yml`, confirmed on baseline `main`)
- `grep -rl "security-planning"` across source directories — zero
matches

## Checklist

### Required Checks

* [x] Documentation is updated (if applicable)
* [x] Files follow existing naming conventions
* [ ] Changes are backwards compatible (if applicable) — **intentional
breaking change per #792**
* [ ] Tests added for new functionality (if applicable) — rename only,
no new functionality

### Required Automated Checks

The following validation commands must pass before merging:

* [x] Markdown linting: `npm run lint:md`
* [x] Spell checking: `npm run spell-check`
* [x] Frontmatter validation: `npm run lint:frontmatter`
* [x] Skill structure validation: `npm run validate:skills`
* [ ] Link validation: `npm run lint:md-links`
* [x] PowerShell analysis: `npm run lint:ps`
* [x] Plugin freshness: `npm run plugin:generate`

## Security Considerations

* [x] This PR does not contain any sensitive or NDA information
* [x] Any new dependencies have been reviewed for security issues
* [x] Security-related scripts follow the principle of least privilege

## Additional Notes

- `extension/package.security-planning.json` and
`extension/README.security-planning.md` referenced in the issue do not
exist in the repo — those acceptance criteria are N/A.
- This is a pre-condition for #793, #794, #795, #796, #797, #798, #799
(MVP security reviewer work).
- The `lint:version-consistency` failure in `lint:all` is a pre-existing
issue on `main` (confirmed by running against baseline) and is unrelated
to this change.

🤖 Generated by Copilot

- replace @agent-name references with agent picker prose in all docs
- add agent picker TIP callout to How to Use sections
- fix security-plan-creator collection path from security-planning to security
- update README prerequisites, getting started table, and sequencing

📝 - Generated by Copilot