From the plan-2 whole-branch review triage (epic #1): commit uv.lock + build image via frozen resolution (reproducibility, cache-friendly layering); non-root USER in runtime image; checksums on fetched helm/kubectl/jar; is_dir filter in the skills guard test; argument-hint frontmatter on commands; guard asserts rpc:/ds:redis: prefixes; buildx cache on release builds; _facts_go cache short-circuit (re-analyzes every run — also affects warm demo GIF timing; relates to #33); blast-radius skill 'empty result' nuance for self-seeding kinds.
From the plan-2 whole-branch review triage (epic #1): commit uv.lock + build image via frozen resolution (reproducibility, cache-friendly layering); non-root USER in runtime image; checksums on fetched helm/kubectl/jar; is_dir filter in the skills guard test; argument-hint frontmatter on commands; guard asserts rpc:/ds:redis: prefixes; buildx cache on release builds; _facts_go cache short-circuit (re-analyzes every run — also affects warm demo GIF timing; relates to #33); blast-radius skill 'empty result' nuance for self-seeding kinds.