fix(review): address review findings (guardrails, prompts, tests, docs)

- permission-gate: block refs/tags/v* pushes, rm -r -f separated flags,
  git reset --hard, git clean (verified against actual bypasses)
- prompts: /bugfix /feature /review no longer hardcode go-standards —
  reference profile-gated <lang>-standards instead
- company-context: drop hardcoded Go stack, note TRACKER_URL priority,
  warn on context truncation instead of silently dropping rules
- repo-map/docs-map: graceful degradation when config values are TODO
- /kit-doctor: warn on unfilled config fields (repoMap/trackerUrl/docsUrl)
- audit: retry POSTs to endpoint (3 attempts, backoff), still best-effort
- install.sh: remove TODO course URL from cheat sheet
- tests: expand guardrails (43 node checks), add shell tests for create-mr.sh
  (scp/https origin parse, GITLAB_HOST override, protected branch refusal),
  cover company-context lib (normalize/fetch/truncation) and mcp-bridge
- commit package-lock.json for reproducible installs
- document npm test Node >= 22.6 requirement (type stripping)

install.sh

@@ -24,7 +24,6 @@ PI_KIT_CHANNEL="${PI_KIT_CHANNEL:-stable}"
 PI_KIT_REPO="git:${PI_KIT_HOST}@${PI_KIT_CHANNEL}"
 
 MIN_NODE_MAJOR=20
-INTERNAL_COURSE_URL="TODO: ссылка на внутренний курс по Pi"
 SETTINGS="$HOME/.pi/agent/settings.json"
 
 # Public skills installed for EVERYONE (repo:skill), via `npx skills add`.
@@ -337,7 +336,5 @@ cat <<EOF
   Команды:       /bugfix <тикет>   /feature <тикет>   /review [фокус]   /rfc <тема>
                  /kit-config   /kit-doctor   /kit-help
   Проверка:      /kit-doctor  — health-check окружения
-
-  Внутренний курс по Pi: ${INTERNAL_COURSE_URL}
 ────────────────────────────────────────────────────────
 EOF