fix(repo): Harden catalog sync and release integrity

Tighten the repo-state automation so canonical bot commits remain
predictable while leaving main clean after each sync.

Make the public catalog UI more honest by hiding dev-only sync,
turning stars into explicit browser-local saves, aligning risk types,
and removing hardcoded catalog counts.

Add shared public asset URL helpers, risk suggestion plumbing,
safer unpack/sync guards, and CI coverage gates so release and
maintainer workflows catch drift earlier.

docs/maintainers/audit.md

@@ -37,6 +37,7 @@ This document summarizes the repository coherence audit performed after the `app
   - missing examples and missing limitations sections,
   - overly long `SKILL.md` files that should probably be split into `references/`,
   - plus the existing structural/safety checks (frontmatter, risk, `When to Use`, offensive disclaimer, dangling links).
+- The report also includes a non-blocking `suggested_risk` for skills that are still marked `unknown` or appear to be misclassified, so maintainers can resolve risk classification during PR review without changing the contributor gate.
 - Use `npm run audit:skills` for the maintainer view and `npm run audit:skills -- --json-out ... --markdown-out ...` when you want artifacts for triage or cleanup tracking.
 
 ### 3. Riferimenti incrociati

docs/maintainers/release-process.md

@@ -75,6 +75,16 @@ npm publish
 Normally this still happens via the existing GitHub release workflow after the GitHub release is published.
 That workflow now reruns `sync:release-state`, refreshes tracked web assets, fails on canonical drift via `git diff --exit-code`, executes tests and docs security checks, builds the web app, and dry-runs the npm package before `npm publish`.
 
+## Canonical Sync Bot
+
+`main` still uses the repository's auto-sync model for canonical generated artifacts, but with a narrow contract:
+
+- PRs stay source-only.
+- After merge, the `main` workflow may commit generated canonical files directly to `main` with `[ci skip]`.
+- The bot commit is only allowed to stage files resolved from `tools/scripts/generated_files.js --include-mixed`.
+- If repo-state sync leaves any unmanaged tracked or untracked drift, the workflow fails instead of pushing a partial fix.
+- The scheduled hygiene workflow follows the same contract and shares the same concurrency group so only one canonical sync writer runs at a time.
+
 ## Rollback Notes
 
 - If the release tag is wrong, delete the tag locally and remotely before republishing.