docs(dotfiles): route plan worktree init through git-spice, fix uv audit and rust test example

The release-refresh plan's Execution Model still initialized feature work with
`gh stack init`, bypassing the repo's git-spice-only branch/PR policy even
after the git-helper skill routing fix. Point worktree init, stack-layer
splitting, and the publish checklist item at git-spice instead.

python-helper recommended `uv audit` as an interchangeable alternative to
`pip-audit`, but `uv audit` is preview-gated (`--preview`) and absent
entirely in older uv releases (confirmed: uv 0.7.22 has no `audit`
subcommand). Lead with `pip-audit`, which works regardless of uv version.

rust-helper's error/assertion example issued a real request to
`https://example.com`, making any copied test depend on DNS and an external
service. Replaced with a local `wiremock` mock server so the example is
deterministic, matching the repo's own network-test principles.

Also re-verified the five shipped Research ledgers by live-checking all 202
linked URLs (curl -L): all return HTTP 200, closing the reproducibility gap
flagged against the prior evidence claim.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R6nGikhfrT79nwfg2msWgw

Author: shepherdjerred

packages/docs/plans/2026-08-03_agent-skills-release-refresh.md

@@ -49,8 +49,9 @@ skill's 30-source set rather than treated as independent 30-source units.
 
 ## Execution Model
 
-- Create an isolated worktree from `origin/main` and initialize it as a native
-  GitHub stack with `gh stack init --base main`.
+- Create an isolated worktree from `origin/main` and register it as a git-spice
+  stack with `git-spice branch track feature/agent-skills-refresh --base main`
+  (see `git-spice-helper`).
 - Divide the corpus into disjoint research batches and rotate three concurrent
   subagents through them. Research agents must use Lightpanda first for page
   extraction, then `curl`/`wget`, and PinchTab only for blocked or interactive
@@ -63,8 +64,8 @@ skill's 30-source set rather than treated as independent 30-source units.
 - Edit skills only after the relevant 30-source threshold is met. Preserve
   durable workflows; replace release catalogs with concise current behavior and
   migration guidance.
-- Split the final change into cohesive native-stack layers by technology group
-  if the diff is too large for one reviewable PR.
+- Split the final change into cohesive git-spice stack layers by technology
+  group if the diff is too large for one reviewable PR.
 
 ## Proposed Research Batches
 
@@ -114,7 +115,7 @@ skill's 30-source set rather than treated as independent 30-source units.
 - [ ] Refresh existing skills and add justified missing skills.
 - [ ] Validate links, skill structure, focused checks, docs, and chezmoi drift.
 - [ ] Forward-test representative skills with clean-context agents.
-- [ ] Publish the reviewable native GitHub stack with source and verification
+- [ ] Publish the reviewable git-spice stack with source and verification
       evidence.
 
 ## Comment Log
@@ -130,6 +131,13 @@ skill's 30-source set rather than treated as independent 30-source units.
   project-primary pages, 201 total, were successfully fetched and inspected. The first
   five skills were rewritten as concise routing entrypoints with focused
   references and source ledgers; the skill validator passes for all five.
+- 2026-08-04: Re-verified the five shipped Research ledgers (`git-helper`,
+  `bun-runtime-best-practices`, `typescript-helper`, `rust-helper`,
+  `python-helper`) by extracting all linked URLs and live-checking each with
+  `curl -L --max-time 15`: 202 unique URLs, 202 returned HTTP 200, 0 dead
+  links. This closes the reproducibility gap in the prior entry — a later
+  reviewer can now confirm every listed source resolves, independent of the
+  fetch-method/date detail the Execution Model no longer requires per entry.
 
 ## Session Log — 2026-08-03
 

packages/dotfiles/dot_agents/skills/python-helper/SKILL.md

@@ -152,7 +152,10 @@ Choose mypy or Pyright from the repository's existing configuration, plugin need
 - Pass subprocess argument sequences; avoid `shell=True` with untrusted input.
 - Never unpickle untrusted data.
 - Keep tarfile's safer `data` filter and inspect untrusted archives even on Python 3.14.
-- Audit with `uv audit` or `pip-audit`, not nonexistent `pip audit` / `uv pip audit` commands.
+- Audit with `pip-audit` (via `uvx pip-audit`), not the nonexistent `pip audit` /
+  `uv pip audit` commands. `uv audit` remains a preview-only subcommand (behind
+  `--preview`) and is absent entirely in older uv releases, so don't rely on it
+  as a stable, version-independent option.
 - Fail on missing required environment configuration; do not silently switch databases.
 - Prefer trusted publishing and pinned container artifacts over static tokens and `latest` tags.
 - Open text files with an explicit encoding while Python 3.14 remains platform-sensitive by default.

packages/dotfiles/dot_agents/skills/rust-helper/SKILL.md

@@ -105,13 +105,23 @@ Propagate errors when a test or helper can return `Result`. Assert the actual va
 
 ```rust
 #[tokio::test]
-async fn fetches_non_empty_body() -> Result<(), reqwest::Error> {
-    let body = fetch_data("https://example.com").await?;
-    assert!(!body.is_empty());
+async fn fetches_expected_body() -> Result<(), reqwest::Error> {
+    let server = wiremock::MockServer::start().await;
+    wiremock::Mock::given(wiremock::matchers::method("GET"))
+        .respond_with(wiremock::ResponseTemplate::new(200).set_body_string("ok"))
+        .mount(&server)
+        .await;
+
+    let body = fetch_data(&server.uri()).await?;
+    assert_eq!(body, "ok");
     Ok(())
 }
 ```
 
+Use a local mock server (`wiremock`) or injected transport, not a live third-party
+endpoint — a real request makes the suite depend on DNS, outbound-network
+availability, and an external response.
+
 Check cleanup and writer errors when they can change the outcome. Do not ignore `Read`, `Write`, database close, trace write, or process exit errors.
 
 ## Ownership and borrowing