chore(privacy): scrub machine paths + drop agentic docs before public

- pyrightconfig: remove absolute C:/ and /mnt/c/ SDK extraPaths, point at .local SDK
- workflows: unpack the SDK under .local/renpy-8.5.3-sdk with its own cache key
- remove tools/trigger_monitor.py + test, and gitignore the tool (hardcodes a local GAMES_ROOT)
- scrub beat_extractor example paths to neutral placeholders
- untrack and gitignore docs/superpowers planning artifacts

Author: guanzo

.claude/skills/release/SKILL.md

@@ -41,13 +41,6 @@ of truth; never retype the number.
    - **Later releases**: run `git-cliff -u` to draft the categorized notes for
      the unreleased range; regenerate `CHANGELOG.md` with `git-cliff`. Save the
      draft to a temp file for step 9.
-   - The repo is **private**, so git-cliff cannot fetch GitHub metadata
-     unauthenticated. Run it with the token exported:
-
-     ```bash
-     export GITHUB_TOKEN="$(gh auth token)"
-     git-cliff -u
-     ```
 
 6. **Dry-run the mod asset** (verify contents, don't ship it):
 

.github/workflows/ci.yml

@@ -113,26 +113,24 @@ jobs:
       # bin/lint.sh calls bare `pyright` (not `poetry run pyright`), so the
       # project venv's bin/ must be on PATH.
       #
-      # pyrightconfig.json's extraPaths point at the SDK (relative ./sdk plus
-      # machine-local absolute paths that don't exist here). Download the SDK
-      # and symlink it into ./sdk so pyright can resolve renpy.* on this
-      # clean runner. The 8.5.3 testcases leg seeds the same version-keyed
-      # cache, so whichever job starts first saves it and the other reads it.
+      # pyrightconfig.json's extraPaths point at the SDK in .local/ (a
+      # gitignored, local-only location this runner must recreate). Download the
+      # SDK and unpack it into .local/ so pyright can resolve renpy.* on this
+      # clean runner. Uses its own cache key (not the harness job's) so the two
+      # jobs can't race on the same key with different path layouts.
       - name: Cache Ren'Py SDK for pyright
         uses: actions/cache@v4
         id: cache-sdk
         with:
-          path: renpy-8.5.3-sdk
-          key: renpy-sdk-8.5.3-${{ runner.os }}
+          path: .local/renpy-8.5.3-sdk
+          key: pyright-sdk-8.5.3-${{ runner.os }}
 
       - name: Download Ren'Py SDK for pyright
         if: steps.cache-sdk.outputs.cache-hit != 'true'
         run: |
+          mkdir -p .local
           curl -fL "https://www.renpy.org/dl/8.5.3/renpy-8.5.3-sdk.tar.bz2" -o sdk.tar.bz2
-          tar xjf sdk.tar.bz2
-
-      - name: Symlink SDK
-        run: ln -s "$PWD/renpy-8.5.3-sdk" sdk
+          tar xjf sdk.tar.bz2 -C .local
 
       - name: Lint
         run: |

.github/workflows/release.yml

@@ -34,24 +34,22 @@ jobs:
           poetry config virtualenvs.in-project true
           poetry install
 
-      # pyrightconfig.json's extraPaths reference ./sdk (and machine-local
-      # paths that won't exist here). Download the 8.5.3 SDK and symlink it so
-      # pyright resolves renpy.* on this clean runner.
+      # pyrightconfig.json's extraPaths point at the SDK in .local/ (a
+      # gitignored, local-only location this runner must recreate). Download the
+      # SDK and unpack it into .local/ so pyright resolves renpy.* here.
       - name: Cache Ren'Py SDK for pyright
         uses: actions/cache@v4
         id: cache-sdk
         with:
-          path: renpy-8.5.3-sdk
-          key: renpy-sdk-8.5.3-${{ runner.os }}
+          path: .local/renpy-8.5.3-sdk
+          key: pyright-sdk-8.5.3-${{ runner.os }}
 
       - name: Download Ren'Py SDK for pyright
         if: steps.cache-sdk.outputs.cache-hit != 'true'
         run: |
+          mkdir -p .local
           curl -fL "https://www.renpy.org/dl/8.5.3/renpy-8.5.3-sdk.tar.bz2" -o sdk.tar.bz2
-          tar xjf sdk.tar.bz2
-
-      - name: Symlink SDK
-        run: ln -s "$PWD/renpy-8.5.3-sdk" sdk
+          tar xjf sdk.tar.bz2 -C .local
 
       - name: Lint
         run: |

.gitignore

@@ -40,3 +40,9 @@ tests/fixtures/data/imports/
 __pycache__/
 tools/beat_extractor/output/
 tools/beat_extractor/samples/
+
+# host-side cron anomaly monitor -- hardcodes a local GAMES_ROOT, not for public
+tools/trigger_monitor.py
+
+# Superpowers agentic planning/design artifacts -- not product docs
+docs/superpowers/