… step

Each adapter step (Discord/Slack/Telegram) now collects tokens inline
instead of deferring to a separate "secrets" step. After saving the
token to the vault, a connection test validates the credential against
the platform API (Discord /users/@me, Slack auth.test, Telegram getMe).
Tests fail gracefully with a warning — they don't block setup.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Replace one-shot token entry with a retry loop via collectAndTestToken().
On connection test failure, the user can re-enter the token or skip
(saving the current token anyway). This prevents typos from requiring
a full re-run of the setup wizard.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

stepHome() now receives which adapters were enabled during the current
wizard run, skipping channel fetches for previously-enabled adapters
that weren't selected this time. Standalone --step home still loads
all enabled adapters.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

initializeWorkspace now accepts { skipQmd } option. The setup wizard
skips QMD on the initial workspace init (Step 1) and runs it during
the final re-initialization with a descriptive spinner so users know
what's happening.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Remove the duplicate initializeWorkspace call at the start of the
wizard. Workspace init, MCP server registration, and QMD model
download now run as the last step with a clear spinner message.
No more lite/skipQmd option — initializeWorkspace always runs fully.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- S-1(setup): Sanitize Telegram token from error messages (URL path leak)
- L-1(setup): Replace magic string check with discriminated union
  ConnectionTestResult { ok, message/error }
- S-2(setup): Skip signingSecret prompt when Slack token is empty
- R-1(init): Deduplicate resolveQmdEntrypoint — export from qmd.ts
- E-1(init): Surface QMD collection add failure as warning instead of
  silently swallowing
- S-1(skills): Add process.exit(2) for danger results in stageSkill scan path
- S-2(skills): Use cleanupStaging() instead of raw rmSync in stageSkill catch

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- skill scan now accepts <ref> (owner/repo, URL) to scan before installing
  instead of requiring an installed skill name. --local flag for existing skills.
- LLM advisory changed from default to opt-in (--llm) since it requires
  ACP session startup (~1min/skill). Static pattern scan is instant.
- Fix DEFAULT_SCAN_MODEL from invalid 'gemini-3.1-pro' to 'pro' (Gemini CLI alias)
- Add Skills section to README with scan/install/manage workflow

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>