Replace the three hand-placed per-harness herdr SessionStart scripts with ONE
neutral, repo-owned script (bin/herdr-agent-state.sh) that takes --source and
--label, so there is no hardcoded harness identity. Point Claude, Codex, and
Cursor hooks at it with their own source/label; deploy it via home.nix. This
makes audit-hook-ownership green for all three (verified by simulation).

- Remove Gemini's workflow-ladder hooks (unowned, hand-placed dead weight) and
  their deployment + ownership check.
- Wire audit-hook-ownership.sh into rebuild.sh (runs after the switch, so the
  deployed script is present and the audit is green).
- audit-doc-freshness: strip code blocks before link scanning and make doc-link
  drift advisory (was flagging code examples like x["embedder"] as broken
  links); real stale-token and absolute-path regressions stay fatal.
- audit-config-ownership: drop content-matches on runtime-mutated files
  (.cursor/cli-config.json, .gemini antigravity settings - finding kunchenguid#9); fix two
  latent set -e/set -u crashes in its advisory existence-check sections
  (unbound ${user} in the LaunchAgent scan, a failing grep substitution) so the
  content-ownership verdict is the exit code.
- Remove herdr runtime session logs still tracked in the tree (Phase 0's
  untracking did not land on this branch's HEAD).

* feat: deterministic hook-ownership audit + fix fail-open audits

Add bin/audit-hook-ownership.sh: for every harness (claude/codex/cursor/gemini)
it resolves the hook config to the actual command target(s) it runs and
classifies each - OWNED (home-manager symlink into nix/repo), UNOWNED
(hand-placed regular file), or MISSING - failing CLOSED on any non-owned or
missing target. This replaces eyeball-grepping a harness dir (or a transcript
log) to guess what a hook runs and who owns it. It currently reports the real
broken state: codex/cursor targets MISSING (exit 127), claude target a manual
regular file, gemini's workflow-ladder scripts unowned.

Fix the fail-open in both existing audits: they hardcoded
/Users/jwalinshah/projects/dotfiles, now a 27-byte pointer file, so
config-ownership died on a bogus mismatch and doc-freshness scanned zero files
and reported ok. Both now resolve the repo from the script's own location (then
~/dotfiles) and fail closed if neither holds home.nix.

Adds tests/audit-hook-ownership.test.sh (owned/unowned/missing classification,
nested gemini shape, fail-closed exit codes). Deploys the new script via
home.nix. Not wired into rebuild.sh yet - it is RED until the hook targets are
repaired (that is the bounded proof task).

* feat: neutral herdr hook + repair harness hook ownership

Replace the three hand-placed per-harness herdr SessionStart scripts with ONE
neutral, repo-owned script (bin/herdr-agent-state.sh) that takes --source and
--label, so there is no hardcoded harness identity. Point Claude, Codex, and
Cursor hooks at it with their own source/label; deploy it via home.nix. This
makes audit-hook-ownership green for all three (verified by simulation).

- Remove Gemini's workflow-ladder hooks (unowned, hand-placed dead weight) and
  their deployment + ownership check.
- Wire audit-hook-ownership.sh into rebuild.sh (runs after the switch, so the
  deployed script is present and the audit is green).
- audit-doc-freshness: strip code blocks before link scanning and make doc-link
  drift advisory (was flagging code examples like x["embedder"] as broken
  links); real stale-token and absolute-path regressions stay fatal.
- audit-config-ownership: drop content-matches on runtime-mutated files
  (.cursor/cli-config.json, .gemini antigravity settings - finding kunchenguid#9); fix two
  latent set -e/set -u crashes in its advisory existence-check sections
  (unbound ${user} in the LaunchAgent scan, a failing grep substitution) so the
  content-ownership verdict is the exit code.
- Remove herdr runtime session logs still tracked in the tree (Phase 0's
  untracking did not land on this branch's HEAD).

---------

Co-authored-by: Jwalin Shah <jwalinshah@gmail.com>

…henguid#9)

.cursor/cli-config.json and .gemini/antigravity-cli/settings.json are runtime
state the apps rewrite (model selection etc.), not declarative config. Managing
them broke rebuilds: cli-config.json (no force) took the backup path and aborted
the whole darwin-rebuild switch when a stale .backup existed, and the gemini one
(force=true) silently wiped your selection every rebuild. Leave both app-owned;
the apps self-initialize them. Removes the rebuild-blocking activation failure.