fix(review): address review findings (guardrails, prompts, tests, docs)

- permission-gate: block refs/tags/v* pushes, rm -r -f separated flags,
  git reset --hard, git clean (verified against actual bypasses)
- prompts: /bugfix /feature /review no longer hardcode go-standards —
  reference profile-gated <lang>-standards instead
- company-context: drop hardcoded Go stack, note TRACKER_URL priority,
  warn on context truncation instead of silently dropping rules
- repo-map/docs-map: graceful degradation when config values are TODO
- /kit-doctor: warn on unfilled config fields (repoMap/trackerUrl/docsUrl)
- audit: retry POSTs to endpoint (3 attempts, backoff), still best-effort
- install.sh: remove TODO course URL from cheat sheet
- tests: expand guardrails (43 node checks), add shell tests for create-mr.sh
  (scp/https origin parse, GITLAB_HOST override, protected branch refusal),
  cover company-context lib (normalize/fetch/truncation) and mcp-bridge
- commit package-lock.json for reproducible installs
- document npm test Node >= 22.6 requirement (type stripping)

extensions/kit-cli.ts

@@ -75,6 +75,13 @@ export default function kitCliExtension(pi: ExtensionAPI) {
 			const cfgOk = typeof cfg.gitHost === "string" && cfg.gitHost !== "TODO";
 			lines.push((cfgOk ? ok : warn)(`config: gitHost=${cfg.gitHost ?? "?"}, tracker=${cfg.trackerUrl ?? "?"}, docs=${cfg.docsUrl ?? "?"}`));
 			if (cfg.remoteConfigUrl) lines.push(ok(`remoteConfigUrl задан`));
+			// TODO-placeholder values are a readiness signal, not an error: warn so
+			// maintainers notice they haven't filled the single source of truth yet.
+			for (const [field, value] of Object.entries({ repoMap: cfg.repoMap, trackerUrl: cfg.trackerUrl, docsUrl: cfg.docsUrl })) {
+				if (typeof value !== "string" || value === "TODO" || value.trim() === "" || value.startsWith("TODO")) {
+					lines.push(warn(`config: ${field} не заполнен (TODO) — скиллы repo-map/docs-map/jira будут просить уточнить`));
+				}
+			}
 
 			// Env vars (presence only, never values)
 			for (const v of ["TRACKER_URL", "JIRA_TOKEN", "GITLAB_TOKEN"]) {