Merge origin/main into garrytan/prompt-injection-guard

Main landed v1.4.0.0 with /make-pdf (PR #1086), so this branch bumps
to v1.5.0.0 and keeps main's entry intact below.

Conflicts resolved:
- CHANGELOG.md: both branches used v1.4.0.0 — renumbered this branch
  to v1.5.0.0, kept main's v1.4.0.0 entry directly below.
- test/skill-validation.test.ts: both branches fixed the same set of
  failing tests. Took main's more conservative assertions (check for
  "Code paths:" / "User flows:" summary labels instead of the older
  "CODE PATHS" / "USER FLOWS" header strings). ALLOWED_SUBSTEPS stays
  the same on both sides.
- bun.lock: kept both new deps (matcher from this branch, marked
  from main's /make-pdf). Verified via bun install.
- scripts/resolvers/preamble/generate-preamble-bash.ts: both branches
  added _EXPLAIN_LEVEL + _QUESTION_TUNING echoes. Kept main's version
  (which has value validation) and removed the duplicate block my
  branch added. Regenerated all SKILL.md files.
- Golden fixtures refreshed after regen.

VERSION: 1.4.0.0 → 1.5.0.0. package.json synced.

All tests pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

bun.lock

@@ -8,6 +8,7 @@
         "@huggingface/transformers": "^4.1.0",
         "@ngrok/ngrok": "^1.7.0",
         "diff": "^7.0.0",
+        "marked": "^18.0.2",
         "playwright": "^1.58.2",
         "puppeteer-core": "^24.40.0",
       },
@@ -257,6 +258,8 @@
 
     "lru-cache": ["lru-cache@7.18.3", "", {}, "sha512-jumlc0BIUrS3qJGgIkWZsyfAM7NCWiBcCDhnd+3NNM5KbBmLTgHVfWBcg6W+rLUsIpzpERPsvwUP7CckAQSOoA=="],
 
+    "marked": ["marked@18.0.2", "", { "bin": { "marked": "bin/marked.js" } }, "sha512-NsmlUYBS/Zg57rgDWMYdnre6OTj4e+qq/JS2ot3KrYLSoHLw+sDu0Nm1ZGpRgYAq6c+b1ekaY5NzVchMCQnzcg=="],
+
     "matcher": ["matcher@3.0.0", "", { "dependencies": { "escape-string-regexp": "^4.0.0" } }, "sha512-OkeDaAZ/bQCxeFAozM55PKcKU0yJMPGifLwV4Qgjitu+5MoAfSQN4lsLJeXZ1b8w0x+/Emda6MZgXS1jvsapng=="],
 
     "mitt": ["mitt@3.0.1", "", {}, "sha512-vKivATfr97l2/QBCYAkXYDbrIWPM2IIKEl7YPhjCvKlG3kE2gm+uBo6nEXK3M5/Ffh/FLpKExzOQ3JJoJGFKBw=="],