Behavior-preserving cleanups:
- extract shared resolveBaseUrl helper for jira/confluence base-URL logic
- extract shared registerTool helper; port jira/gitlab/confluence tools to it
- make scanSecrets declarative (filter/map)
- collapse ok/warn pair into status() and drop double existsSync in kit-doctor
Typecheck clean; npm test 71 PASS, 0 FAIL.
- /kit-doctor: environment health check (node, kit version/channel, config source+values, env vars presence, env.sh, loaded command/skill counts) with pass/warn summary; read-only, offline-safe
- /kit-help: catalog of package commands + skills (filtered to package path) + static guardrail list
Verified live via pi RPC: both commands register and render.