[3/3] feat!: remove personal squads, consult mode and the global squad; project-only resolution; F6/F7/F8 - #2279

…rune retired exports; guard tests from the real profile [3/3]

Worf Layer C review (LC-1..6) and the test-profile incident:

- LC-2 (data integrity): both squad-dir walkers (resolveSquad, resolveSquadPaths/
  findSquadDir) stop at the home directory and never accept ~/.squad or SQUAD_HOME as a
  project squad, so `squad cast` from a directory without a repo marker can no longer
  write into the profile. Tests: tombstone unit test (fake HOME/USERPROFILE/SQUAD_HOME,
  no .git, zero fs hits) and a built-CLI test (cast/status/doctor/cost fail with the
  remediation message, fake profile sha256-identical) — verified red pre-fix
  (`Added agent Probe` under fake-home/.squad).
- LC-3: `--global` on any command fails with `Unknown option: --global` (exit 1) instead
  of silently running the project form; test for init/upgrade.
- LC-1: `./commands/extract` and `./commands/personal` exports removed from the CLI
  package.json; the retired-symbol gate now scans both manifests' `exports` (retired
  names + every target must exist in dist; the pre-existing dangling
  `./shell/sdk-bridge` is listed as known) and the `npm pack --dry-run` file lists.
- Incident: new vitest setupFile `test/setup/profile-guard.ts` redirects SQUAD_HOME,
  APPDATA, LOCALAPPDATA and XDG_CONFIG_HOME into a per-worker temp dir before any test
  loads, so no test can read or write the real profile (HOME/USERPROFILE untouched so
  git/gh keep working; the walker fix covers ~/.squad).
- LC-4: squad-home docs no longer speak of "personal agents". LC-5: the single BREAKING
  sentence is repeated verbatim once in whatsnew v2.0.0 and the upgrading guide (gate
  enforces exactly once, nothing else). LC-6: `health` help line shortened.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: b822a455-fa94-49a2-9127-eee479ab954e

…zation check [3/3]

Data's upgrade matrix (#2282) findings UM-F1 and UM-F2:

- UM-F1: projects initialized by 0.13-1.1 while a profile squad existed carry
  `teamRoot: "<platform-config>/squad"`. `isRetiredProfileTeamRoot()` (SDK) recognises
  the platform config dir, `~/.squad`, `SQUAD_HOME` and the home dir; `resolveSquadPaths`
  never follows such a teamRoot (local mode), and `squad upgrade` removes the key with one
  neutral line ("Removed stale teamRoot pointing to <path>; project state is now local";
  --dry-run only announces). A genuine dual-root teamRoot (another repo) is preserved.
- UM-F2: `stripAgentStamps()` normalizes every stamp form the upgrader writes
  (`<!-- version: X -->`, `- **Version:** X`, `Squad vX`, `@bradygaster/squad-cli@X`,
  legacy `<!-- squad-cli vX -->`) before comparing squad.agent.md with the template, and an
  existing `.local-backup` holding the same bytes is not rewritten.
- Docs: upgrading guide notes both and adds "Downgrading and old CLIs" guidance.
- Tests: test/upgrade-profile-teamroot.test.ts (6) — both findings verified red against
  the pre-fix SDK/CLI (remote mode; "local customizations" warning on pass 1).

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: b822a455-fa94-49a2-9127-eee479ab954e

…ormalization, tolerant teamRoot preflight [3/3]

Copilot review threads on #2279:

- doctor: the resolver is the single admission check (a bare ./.squad existence check let
  `squad doctor` run from the home directory against ~/.squad); test now also runs every
  outside-project command directly from the seeded home dir (red pre-fix for doctor).
- upgrade: the stale-teamRoot preflight tolerates null/array/scalar config.json like
  readSquadConfig (test); stripAgentStamps normalizes only the version token on the
  `- **Version:**` line so an edited instruction is still a customization (test).
- resolveGlobalSquadPath honours XDG_CONFIG_HOME on macOS as well, so the test profile
  guard (and the outside-project test, which no longer overrides HOME) isolates macOS too.
- retired-symbols gate: validates the changeset fragment only while it exists (changeset
  version consumes it); post-release it requires the sentence in the CLI CHANGELOG; the
  whatsnew/upgrading exactly-once checks stay durable.
- cast: outside-project message aligned with status/doctor ("No squad in this directory
  (searched from ...). Run "squad init" here, or use --team-root ...").

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: b822a455-fa94-49a2-9127-eee479ab954e

…acceptance/portability expectations for 2.0 [3/3]

CI on 21ecca7 (ubuntu) — all branch-caused, all from the last two commits:

- Profile boundary compared `os.homedir()` with the walk's current path textually; on
  Windows `os.tmpdir()` yields the 8.3 form (`C:\Users\SOMEUS~1\...`) so the boundary was
  missed and `squad status` from a temp dir resolved `~/.squad` (acceptance saw
  `Path: C:\Users\TAMIRD~1\.squad`). Boundary comparisons now use `realpathSync.native`
  on the longest existing prefix (`canonicalDir`); callers still get paths in their own
  spelling (resolve-cache tests unchanged).
- test/setup/profile-guard.ts: SQUAD_HOME is redirected to `<guard>/home/.squad` so the
  path keeps its real shape (comms-teams tests assert the `.squad` segment).
- acceptance features: outside a project `squad status`/`squad doctor` now fail with
  "No squad in this directory … squad init" (exit 1) — the 2.0 contract, replacing the
  old fallback expectations.
- cli/upgrade-portability: the fixture asserted the UM-F2 bug (a stamp/CRLF-only delta
  produced a .local-backup); it now applies a genuine local edit, which is still backed up.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: b822a455-fa94-49a2-9127-eee479ab954e

…-closed canonicalization, fs guard, one-pass 0.9.x upgrade [3/3]

Q/Bubu/Worf conditions on Layer C:

- LC-9: one message for every project-scoped command, from `NO_SQUAD_MESSAGE` /
  `fatalNoSquad()`: `No squad in this directory. Run "squad init" first.` (status, doctor,
  cast, cost, upgrade, nap, export, notes, upstream, economy, config, loop, watch, migrate,
  copilot). economy/config used private walkers that reached ~/.squad — replaced by the
  SDK resolver. Test runs 11 commands from an empty repo, asserts the identical line,
  exit 1, and that nothing (no .squad mkdir) is created.
- LC-11: the platform config dir (%APPDATA%\squad, ~/.config/squad, ~/Library/…/squad)
  is part of the profile boundary: a `.squad` at or under it is never admitted (any
  spelling), and the boundary is established by canonicalizing only the PARENT so the
  retired directory itself is never stat'ed.
- LC-12: canonicalization is fail-closed — `canonicalDir` returns null when the existing
  prefix cannot be realpath'ed and callers refuse (resolver returns null, teamRoot treated
  as retired) instead of comparing lexically; an unknown home dir also refuses. A link
  named `.squad` whose target is profile-owned is refused too.
- Fail-closed test guard: `test/setup/profile-fs-guard.cjs` wraps fs/fs.promises (sync,
  callback, promise) and THROWS on any access under the real profile roots; loaded by the
  vitest setup file from the original environment and inherited by child processes via
  NODE_OPTIONS=--require + SQUAD_TEST_FORBIDDEN_ROOTS. test/profile-fs-guard.test.ts proves
  a deliberate access throws in-process and in a child with faked HOME/APPDATA.
- Projects under the profile keep working: test/profile-boundary.test.ts covers
  <home>/src/proj, long/8.3 paths (skips loudly when 8.3 is disabled), case/separator
  variants, a junction to the profile root, SQUAD_HOME/APPDATA/HOME/USERPROFILE variants.
- F4 (Data, upgrade matrix): the casting pair is ensured BEFORE squad.agent.md is rendered,
  so a 0.9.x project (empty casting/) gets the capabilities block on the first upgrade and
  the second upgrade is a byte-identical no-op.
- Eradication boundary: the teamRoot cleanup prints `Removed obsolete "teamRoot" setting
  from .squad/config.json.` (no path).
- Single historical record: the BREAKING sentence lives only in whatsnew v2.0.0; the
  upgrading guide links to that section; the retired-symbol gate enforces both.

LC-9 equality, LC-11, LC-12 and F4 tests verified red against the pre-fix code.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: b822a455-fa94-49a2-9127-eee479ab954e

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: b822a455-fa94-49a2-9127-eee479ab954e

…ev by #2285) [3/3]

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: b822a455-fa94-49a2-9127-eee479ab954e