chore: user-* 名前空間を個人設定用に予約（v0.71.1）

CHANGELOG.md

@@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/), and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [0.71.1] - 2026-06-12
+
+### Added
+- **`user-*` 名前空間の予約を規約化**: kit は `rules/user-*.md` 等の `user-*` 名のファイルを配布しないことを CLAUDE.md の Key Conventions に明文化し、CI テストで強制。ユーザーが個人の常時ロードルールを `~/.claude/rules/user-*.md` に置いても、将来の kit 更新で同名配布による無確認上書き（`_update_file()` は snapshot のない kit 新規ファイルを確認なしでコピーする）が起きないことを保証する
+
 ## [0.71.0] - 2026-06-12
 
 v0.57.0〜v0.70.0 の累積差分に対する multi-agent 通しレビュー（8 次元 + 14 Issue 受け入れ照合 + 敵対的検証）のフォローアップ（#138）。

CLAUDE.md

@@ -191,6 +191,7 @@ Rules to remember: verify fresh install, `setup.sh --update`/`/update-kit`, and
 
 - **Prerequisites auto-install**: The main setup flow requires `git`, `jq`, `curl`, GNU `sed`, GNU `awk`, `bash 4+`, `node`, `tmux`, and `gh`. Stage 1 bootstrap (`wizard/wizard.sh`, `lib/colors.sh`, `lib/detect.sh`, `lib/prerequisites.sh`) remains Bash 3.2 compatible so the kit can auto-install or detect Bash 4+ and re-exec before Stage 2 (`declare -A`, `readarray`, etc.). Only show manual install commands after automatic installation fails.
 - **Variable naming**: `ENABLE_*` (feature toggles), `INSTALL_*` (component flags), `STR_*` (i18n strings), `_*` prefixed functions (private/internal)
+- **Reserved user namespace**: the kit MUST NOT ship files matching `rules/user-*.md` (or `user-*` trees under other managed dirs). Users place personal always-loaded rules there; `_update_file()` would silently overwrite a same-named user file on update because a kit-new file has no snapshot baseline.
 - **Boolean handling**: `_bool_normalize()` accepts true/1/yes/on → "true". Use `is_true()` for checks.
 - **No eval**: All dynamic variable assignment uses `printf -v` and `${!var}` (indirect expansion) to prevent injection.
 - **Ghostty detection**: Use `[[ -x "/Applications/Ghostty.app/Contents/MacOS/ghostty" ]]` to detect Ghostty. Never use `-d "/Applications/Ghostty.app"` or `command -v ghostty` (both produce false positives).

tests/unit/test-content-cleanup.sh

@@ -110,3 +110,13 @@
     fail "$test_name"
   fi
 }
+
+{
+  test_name="content-cleanup: kit never ships files in the reserved user-* namespace"
+  if ! find "$PROJECT_DIR/rules" "$PROJECT_DIR/agents" "$PROJECT_DIR/commands" "$PROJECT_DIR/skills" \
+      -name 'user-*' -print 2>/dev/null | grep -q .; then
+    pass "$test_name"
+  else
+    fail "$test_name"
+  fi
+}