docs(dotfiles): reconcile plan/reference docs with git-spice and uv-audit fixes

Round 3 follow-up: the previous commit fixed the Execution Model's own
wording but left three things inconsistent:

- The Comment Log still described the worktree as native-`gh stack`
  initialized with no reconciling note, and the matching Remaining checkbox
  still said "native-stack worktree" — both contradicted the corrected
  Execution Model. Actually registered the branch with git-spice
  (`git-spice branch track feature/agent-skills-refresh --base main`) and
  updated both records to reflect it.
- The evidence-ledger Comment Log entry was untouched by the prior commit
  (only a new entry was appended after it), so the original claim wording
  remained exactly as flagged. Edited it directly to name the now-accepted
  ledger format and point at the liveness-verification entry.
- `python-helper/references/tooling-and-packaging.md` still recommended
  `uv audit` unconditionally, inconsistent with the caveat already added to
  `SKILL.md`. Aligned the wording.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R6nGikhfrT79nwfg2msWgw

Author: shepherdjerred

packages/docs/plans/2026-08-03_agent-skills-release-refresh.md

@@ -106,7 +106,7 @@ skill's 30-source set rather than treated as independent 30-source units.
 
 - [x] Confirm that “30 sources” means per top-level skill, with commands and
       libraries inside that skill covered by the same 30-source set.
-- [x] Create and initialize the isolated native-stack worktree.
+- [x] Create the isolated worktree and register it as a git-spice stack.
 - [x] Inventory the full corpus, existing references, current versions, and
       missing high-value skills.
 - [ ] Run the multi-agent research batches and build the per-skill evidence
@@ -125,19 +125,31 @@ skill's 30-source set rather than treated as independent 30-source units.
   user change to `bugsink-helper/SKILL.md`, which must be preserved.
 - 2026-08-03: The user confirmed the 30-source requirement applies per
   top-level skill. Created `.claude/worktrees/agent-skills-refresh` on
-  `feature/agent-skills-refresh` and initialized it with native `gh stack`.
+  `feature/agent-skills-refresh`, at the time initialized with native
+  `gh stack` per the then-current policy. That policy was reverted repo-wide
+  to git-spice-only on 2026-08-03 (#1970); see the 2026-08-04 entry below for
+  the correction.
 - 2026-08-03: Completed the first two research waves for Git, Bun, TypeScript,
   Rust, and Python: 186 primary pages plus 15 supplemental official or
   project-primary pages, 201 total, were successfully fetched and inspected. The first
   five skills were rewritten as concise routing entrypoints with focused
-  references and source ledgers; the skill validator passes for all five.
+  references and Research ledgers (numbered title/URL lists, the format the
+  Execution Model now specifies — not the richer fetch-method/retrieval-result/
+  date-version ledger originally described); the skill validator passes for
+  all five. See the 2026-08-04 entry below for independent liveness
+  verification of every listed source.
 - 2026-08-04: Re-verified the five shipped Research ledgers (`git-helper`,
   `bun-runtime-best-practices`, `typescript-helper`, `rust-helper`,
   `python-helper`) by extracting all linked URLs and live-checking each with
   `curl -L --max-time 15`: 202 unique URLs, 202 returned HTTP 200, 0 dead
   links. This closes the reproducibility gap in the prior entry — a later
   reviewer can now confirm every listed source resolves, independent of the
   fetch-method/date detail the Execution Model no longer requires per entry.
+- 2026-08-04: Registered `feature/agent-skills-refresh` with git-spice
+  (`git-spice branch track feature/agent-skills-refresh --base main`),
+  reconciling the branch's actual tracking with the corrected Execution
+  Model. The branch is git-spice-tracked going forward; no `gh stack` state
+  remains authoritative for this work.
 
 ## Session Log — 2026-08-03
 

packages/dotfiles/dot_agents/skills/python-helper/references/tooling-and-packaging.md

@@ -51,7 +51,7 @@ Use the repository's chosen checker and configuration. Do not add `--ignore-miss
 
 ## Auditing and images
 
-Use `uv audit` for current uv projects or `pip-audit` for supported environments, requirements, and lockfiles. Vulnerability findings require reachability and remediation review; the command must remain a failing gate when policy requires it.
+Use `pip-audit` (via `uvx pip-audit`) for environments, requirements, and lockfiles; it works regardless of uv version. `uv audit` remains a preview-only subcommand (behind `--preview`) and is absent entirely in older uv releases, so do not depend on it unconditionally. Vulnerability findings require reachability and remediation review; the command must remain a failing gate when policy requires it.
 
 Pin container tools by reviewed version or immutable digest. Do not copy `latest` into a reproducible build.