1.6.0 — skills-format migration, lint retired-path fix, plugin.json completeness

Skills migration: each of the eight slash commands gains a skills/<name>/SKILL.md
twin (same invocation name, byte-identical body). Per-skill allowed-tools
pre-authorize the resolved python3/python/py -3 invocations + the CoWork ls
fallback probe; disable-model-invocation: true makes /echo-sweep and /echo-triage
operator-only. Docs-confirmed: a same-name skill takes precedence over the legacy
command, so commands/ coexists until its scheduled 2.0 deletion. The $ECHO
path-resolution dedupe is resolved as not-supported (skill dirs are
self-contained; no cross-skill snippet sharing).

Lint fix: vault_lint.py checks retired patterns BEFORE routes, so a seed README
inside a retired tree (archive/...) flags retired-path instead of being absolved
by the permissive leaf-readme route. New end-to-end regression test seeds
archive/notes/README.md (fails pre-fix, passes now).

plugin.json: version 1.6.0, homepage + repository -> git.alwisp.com/jason/echo.

All suites green: 25/25 client unit tests (incl. routing-sync guard), feature,
reflect, offline-queue, PATCH-semantics. Artifact rebuilt (87 entries, both
formats); pointer refreshed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

TODO-1.6.md

@@ -14,22 +14,27 @@ the official docs (code.claude.com/docs/en/skills.md, plugins.md):
   invocation name: `/echo-save` works identically. No deprecation date on `commands/`;
   this is future-proofing, not a fire.
 - **Do it for the features, not the notice:**
-  - [ ] `allowed-tools` per skill — pre-authorize the resolved `python3 "$ECHO" …`
-        invocations so `/echo-load`, `/echo-health`, `/echo-recall` stop prompting
-        (1.4.2 hand-broadened two commands; the skill format does this properly).
-  - [ ] `disable-model-invocation: true` on the write-heavy entry points
-        (`/echo-sweep`, `/echo-triage`) so only the operator triggers them; leave the
-        read-side ones model-invocable.
-  - [ ] De-duplicate the CoWork `$ECHO` path-resolution block currently copy-pasted
-        into all eight command bodies — each skill folder can carry a shared snippet.
-  - [ ] `argument-hint` carries over as-is; `$ARGUMENTS` substitution unchanged.
+  - [x] `allowed-tools` per skill — **done 1.6.0** (all eight skills pre-authorize
+        the resolved `python3`/`python`/`py -3` invocations + the CoWork `ls` probe).
+  - [x] `disable-model-invocation: true` on the write-heavy entry points
+        (`/echo-sweep`, `/echo-triage`) — **done 1.6.0**; read-side stays
+        model-invocable.
+  - [x] De-duplicate the CoWork `$ECHO` path-resolution block — **resolved 1.6.0 as
+        not-supported**: per the official skills docs, skill directories are
+        self-contained (no cross-skill snippet sharing), so the 2-line block stays
+        per-skill. Docs confirmed same-name skill takes precedence over the legacy
+        command, so coexistence is safe.
+  - [x] `argument-hint` carries over as-is; `$ARGUMENTS` substitution unchanged —
+        **done 1.6.0** (save/recall/reflect).
 - [ ] Verify a migrated build installs cleanly on desktop **and** in a CoWork session
       before deleting `commands/` (deleting the legacy dir is a 2.0 item —
-      see `ROADMAP-2.0.md`; in 1.6 both may coexist).
+      see `ROADMAP-2.0.md`; in 1.6 both may coexist). *(1.6.0 artifact built —
+      operator install test pending.)*
 
 ## 2. plugin.json completeness (from the old MAINTENANCE checklist)
 
-- [ ] Add `homepage` / repository URL — now decided: `https://git.alwisp.com/jason/echo`.
+- [x] Add `homepage` / repository URL — **done 1.6.0**: both `homepage` and
+      `repository` set to `https://git.alwisp.com/jason/echo`.
 
 ## 3. Vault follow-ups (noticed during the 1.5.0 dead-link cleanup)
 
@@ -46,7 +51,9 @@ they were unwrapped per instruction but repointing them would restore real graph
 
 *(add items here as the new plugin gets real use)*
 
-- [ ] **Lint blind spot: retired dirs masked by the leaf-README route** (found 2026-07-03).
+- [x] **Lint blind spot: retired dirs masked by the leaf-README route** (found
+      2026-07-03; **fixed 1.6.0** — retired patterns now checked before routes, with
+      the `archive/notes/README.md` regression test).
       `archive/` and `_agent/outputs/` are retired/unrouted pre-0.6 leftovers that survived
       in the live vault holding only their seed READMEs — and the permissive `leaf-readme`
       route (`^(.+/)?README\.md$`) matches first, so `vault_lint` never flagged them.