fix: preserve autoplan tasks and hide Render key bytes

[time-attack]

Summary

• Fix autoplan's task-record aggregation so records whose commit exactly matches a commit in the current review range are retained instead of triggering jq's Cannot index array with string "commit" error.
• Stop setup-deploy's Render instructions from printing the first four bytes of RENDER_API_KEY; report only set or not set.
• Add focused regression coverage for both defects and keep generated skill output synchronized with its template/resolver sources.

This is the reconstructed, minimal package from the wave-skill-pipeline review. It intentionally excludes the old 177-file wave branch and all changes that lacked sufficient attribution, scope, or live evidence.

Test coverage

• 813 passing targeted generation, host, validation, idempotency, and regression tests; 0 failures; 7,947 assertions.
• 1,000 randomized autoplan aggregation cases passed.
• 9 adversarial Render-key values passed, including newlines, Unicode, shell substitutions, and metacharacters; no secret bytes leaked and no payload executed.
• bun run build passed.
• Generated output freshness and git diff --check passed.

Live baseline/candidate evidence

• Autoplan aggregation: three real affected consumer repositories fail on immutable origin/main with jq exit 5 and pass on this candidate; two causal controls remain passing.
• Render credential output: three affected repositories expose synthetic key bytes on immutable origin/main and do not expose them on this candidate; two controls remain passing.
• Paid isolated autoplan sessions completed on both baseline and candidate. The candidate completed all review phases and invoked both Codex and Claude outside voices.

Independent review

Authenticated Claude Opus 4.7 and GPT-5.4 reviews independently reproduced both baseline defects, exercised candidate edge cases, found no merge blocker, and recommended both commits.

Known unrelated baseline failures

Six environment-dependent tests reproduce identically on immutable origin/main and this branch: five PATH/tool assumptions in gbrain-detect-install and one local endpoint-hash expectation. They do not touch the changed skills and are not candidate regressions.

Commits

• 377b0747 — fix(autoplan): preserve matching task records (#2021)
• b9d48195 — fix(setup-deploy): avoid exposing Render key bytes (#1096)

Review artifact

The exhaustive 83-PR wave accounting and retained evidence remain local under .review/ and are intentionally not committed to the product branch.