v0.26.3 — fix(remote): HTTP Basic auth for on-host clone/pull

ci: manage stale issues and pull requests (#270)

Adds a daily stale-management workflow with a 21-day inactivity window
and 7-day close window for issues and pull requests. Activity
automatically removes the stale label. Security, pinned, never-stale,
ready-for-ada, assigned, and milestoned work is exempt as applicable.
Processing is capped at 10 operations per run to avoid notification
bursts, permissions are least-privilege, and actions/stale v9 is pinned
to an immutable commit.

fix: restart agent-vault during provisioning (#269)

## Summary
- restart agent-vault after installing its pinned binary and unit
- ensure listener contract changes take effect before health and API
operations

## Root cause
systemctl enable --now does not re-execute an already-running service.
Upgrading the proxy binary and generated unit could therefore leave the
previous process serving an incompatible listener protocol until the
next reboot or manual restart.

## Verification
- go test ./...

fix: make Codex runtime updates transactional (#268)

## Summary
- stage and validate Codex updates before atomically promoting them
- check daily and require a 24-hour release soak; disable Codex startup
self-updates
- retain rollback/quarantine state for early startup failures
- upgrade agent-vault to v0.25.0 so platform tarballs larger than 100
MiB stream successfully

## Root cause
agent-vault v0.22.0 truncated the Codex Linux platform tarball at
exactly 100 MiB. npm treats the platform package as optional, exits 0,
and leaves only a launcher that fails at startup. In-place per-iteration
installs replaced the last working runtime.

## Verification
- go test ./...

Make Codex/OpenCode adapters consume shared skills and MCP config (#266)

## Summary
- sync one `skills_repo` into Claude Code, Codex, and OpenCode discovery
paths
- generate one runtime-neutral MCP manifest and translate it in
Codex/OpenCode runners
- reliably submit Codex prompts containing `$` shell variables
- report Codex authentication correctly in `clem status`
- document the existing `runtime: codex` support

## Verification
- `go test ./...`
- exercised generated runners for each supported runtime
- verified skill discovery and MCP translation across runtime adapters

---------

Co-authored-by: Local Clem Patch <local@invalid>