Add TODO-1.6 + ROADMAP-2.0; retire MAINTENANCE.md and the codex tree

- TODO-1.6.md: skills-format migration of the eight slash commands
  (allowed-tools, disable-model-invocation, de-duped $ECHO block),
  plugin.json homepage, vault link repoints, and an open section for
  findings from 1.5.x live testing.
- ROADMAP-2.0.md: packaging & structure major — repo artifact policy
  (Gitea releases, prune versioned zips), delete legacy commands/ dir,
  codex-as-build-target if ever needed, eval refresh to current
  metrics. Includes a disposition table absorbing every open
  MAINTENANCE.md item, so that checklist is removed.
- Delete "codex plugin/": drifted derived tree; operator decision to
  regenerate from the canonical source after 2.0 if Codex use returns.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

TODO-1.6.md

@@ -0,0 +1,49 @@
+# echo-memory — v1.6 TODO
+
+> Working list for the next minor release. Started 2026-07-03, right after 1.5.1
+> shipped. **Add findings from 1.5.x live testing to the "Surfaced in testing"
+> section as they come up** — that's what this doc is for.
+
+## 1. Migrate the eight slash commands to the skills format
+
+The installer flags the plugin's `commands/` directory as the legacy format
+("Both formats work — consider migrating to skills/*/SKILL.md"). Confirmed against
+the official docs (code.claude.com/docs/en/skills.md, plugins.md):
+
+- **Non-breaking.** `commands/echo-save.md` → `skills/echo-save/SKILL.md` keeps the
+  invocation name: `/echo-save` works identically. No deprecation date on `commands/`;
+  this is future-proofing, not a fire.
+- **Do it for the features, not the notice:**
+  - [ ] `allowed-tools` per skill — pre-authorize the resolved `python3 "$ECHO" …`
+        invocations so `/echo-load`, `/echo-health`, `/echo-recall` stop prompting
+        (1.4.2 hand-broadened two commands; the skill format does this properly).
+  - [ ] `disable-model-invocation: true` on the write-heavy entry points
+        (`/echo-sweep`, `/echo-triage`) so only the operator triggers them; leave the
+        read-side ones model-invocable.
+  - [ ] De-duplicate the CoWork `$ECHO` path-resolution block currently copy-pasted
+        into all eight command bodies — each skill folder can carry a shared snippet.
+  - [ ] `argument-hint` carries over as-is; `$ARGUMENTS` substitution unchanged.
+- [ ] Verify a migrated build installs cleanly on desktop **and** in a CoWork session
+      before deleting `commands/` (deleting the legacy dir is a 2.0 item —
+      see `ROADMAP-2.0.md`; in 1.6 both may coexist).
+
+## 2. plugin.json completeness (from the old MAINTENANCE checklist)
+
+- [ ] Add `homepage` / repository URL — now decided: `https://git.alwisp.com/jason/echo`.
+
+## 3. Vault follow-ups (noticed during the 1.5.0 dead-link cleanup)
+
+Three of the 27 unwrapped "dead" links were actually **typos pointing at real notes**;
+they were unwrapped per instruction but repointing them would restore real graph edges:
+
+- [ ] `projects/active/forgerunner.md` + `_agent/sessions/2026-06-29-2200-forgerunner-v010-ship.md`:
+      "Gitea CI Docker jobs run on the host label" → the decision
+      `decisions/by-date/2026-06-29-gitea-ci-docker-jobs-run-on-the-host-lab.md` ("lab", not "label").
+- [ ] `projects/active/mpm-brand-voice.md`: "Message Point Media (MPM)" ×3 → the company
+      note `resources/companies/mpm.md` (or whatever is canonical for MPM).
+
+## 4. Surfaced in 1.5.x testing
+
+*(add items here as the new plugin gets real use)*
+
+- [ ] —