chore(swarm): Stage B/C/D — proactive health, humanization, polish

Dogfood swarm Stage B audit (proactive lens) found 71 future-proofing,
observability, and defensive-coding gaps. Stage C/D amend addresses them
across all 5 owned domains.

Scripts UX (marketing/scripts/):
- --root <path> + MCPT_MARKETING_ROOT env (alternate marketing trees)
- --help, --version on all 3 scripts
- --json, --quiet, --verbose modes on validate.mjs
- atomic lockfile write (tmp + crypto.randomUUID + fs.rename)
- schemaVersion preflight check (I15) on every loaded document
- --max-evidence-bytes <N> guard (default 100 MiB)
- path-traversal errors split into specific named branches
- loadJson moved into _paths.mjs (single I/O surface)
- explicit "Evidence manifest: N entries" line + warn when proven claims
  exist with empty manifest

Schema future-proofing (marketing/schema/):
- aliases[] on every IDed entity (downstream rename resolution)
- field-level deprecation pattern (JSON Schema 2019-09 deprecated: true)
- lastModified + contentHash optional shape fields
- x-* extension carve-out (forward-compat experimentation)
- messageChannel + pressContactMethod oneOf [closed-enum, x-pattern]
- $defs/graduation block for aspirational claims
- examples[] on 9 high-leverage types
- defaults on 3 enums
- top-level schemaVersion: "1" + version-aware $id (/schema/v1/...)
- projectForbiddenPhrases + projectPreferredNouns hooks on index
- aliases ["claim.zip-meta-map.246-tests"] on test-suite (concrete proof)
- graduation blocks on all 6 zip-meta-map aspirational claims with
  blockedBy + targetDate

Test coverage (test/):
- 46 → 73 tests (+27)
- I12-extended scope negative test (audience+campaign forbidden phrases)
- gen-lock --check missing-lockfile and malformed-lockfile branches
- validate error envelopes: malformed JSON, manifest shape, traversal
- _paths leading-dot rejection tests
- schema-vs-runtime consistency invariant suite (pins drift)
- test/helpers/temp-tree.mjs extracted (no more inline tree builders)
- test:gen-lock, test:validate, test:hash-file, test:_paths, test:version,
  test:watch, test:coverage scripts

CI release flow (.github/):
- workflows/release.yml — tag-driven, validates tag↔package.json,
  CHANGELOG section gate, gh release create --generate-notes
- workflows/scorecard.yml — OSSF Scorecard, SHA-pinned, weekly
- $GITHUB_STEP_SUMMARY lines per gate
- npm ci retry on transient failures
- Node 20 back in matrix (auto-discovery script form works on 20+)
- CodeQL dropped PR trigger (over-eager for 300 LoC)
- PULL_REQUEST_TEMPLATE.md (Summary / Falsifiability / Test plan)
- ISSUE_TEMPLATE/bug.yml + feature.yml + config.yml
- .gitignore expanded (*.log, *.tgz, competing lockfiles, build caches)

Doc completeness (root):
- CONTRIBUTING.md (150 lines) — quick start, dev loop, adding tools/claims,
  schema changes, forbidden phrases, honesty principles
- RELEASING.md (134 lines) — pre-release checks, version-bump rules,
  7-step release sequence, hot-fix process
- ARCHITECTURE.md (155 lines) — why MarketIR, core invariants, data flow,
  components, design rationale, extension points
- ROADMAP.md (74 lines) — currently shipped, pre-launch deps, v1.1 plans
- README de-duped (audit-date → SCORECARD, test-count → Testing section,
  data-scope → SECURITY)
- README adds Consumer contract, Versioning policy, Troubleshooting,
  Scripts reference

5 owned domains, exclusive file ownership enforced.
Final state: validate ✓ lock:check ✓ 73/73 tests ✓ fmt:check ✓
Schema 19,350 → 35,129 bytes (more strict, more flexible at extension points).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: mcp-tool-shop

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,78 @@
+name: Bug report
+description: A script, schema, or claim is producing the wrong result.
+title: "[bug] "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to file a clear bug. The repo's thesis is that
+        claims are falsifiable — bug reports are most useful when they include
+        the exact command, the actual output, and what you expected instead.
+
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: Tag or commit SHA you're on (e.g., `v1.0.0`, `abcdef0`).
+      placeholder: v1.0.0
+    validations:
+      required: true
+
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating system
+      options:
+        - Linux
+        - macOS
+        - Windows
+        - Other (describe in steps)
+    validations:
+      required: true
+
+  - type: input
+    id: node
+    attributes:
+      label: Node version
+      description: Output of `node --version`. The repo supports Node 20+.
+      placeholder: v22.10.0
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: Exact commands. Paste output as-is — do not summarize.
+      placeholder: |
+        1. `git clone https://github.com/mcp-tool-shop/mcpt-marketing`
+        2. `cd mcpt-marketing && npm ci`
+        3. `npm run validate`
+        4. ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected result
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual result
+      description: Include the full error message and any stack trace.
+    validations:
+      required: true
+
+  - type: textarea
+    id: extra
+    attributes:
+      label: Anything else?
+      description: Logs, screenshots, related issues. Optional.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,13 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Question or discussion
+    url: https://github.com/mcp-tool-shop/mcpt-marketing/discussions
+    about: |
+      Open-ended questions ("how would I…", "should this…", "what about…")
+      belong in Discussions. The issue tracker is for bugs and concrete
+      feature requests.
+  - name: Security report
+    url: https://github.com/mcp-tool-shop/mcpt-marketing/security/advisories/new
+    about: |
+      Report a security vulnerability privately via GitHub Security
+      Advisories. Do not open a public issue for security reports.

.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,54 @@
+name: Feature request
+description: Propose a new claim, schema field, script, or workflow capability.
+title: "[feature] "
+labels:
+  - enhancement
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Feature requests are most useful when they describe the problem before
+        the solution. If you're proposing a new claim or schema field, include
+        what evidence would back it and what would falsify it.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What is hard, missing, or wrong today? Be concrete.
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: |
+        What would change. If it's a script or schema change, sketch the shape
+        (sample input, sample output, error message). If it's a new claim,
+        describe the evidence it would cite.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: What else did you think about, and why is the proposal better?
+    validations:
+      required: false
+
+  - type: textarea
+    id: scope
+    attributes:
+      label: Scope and falsifiability
+      description: |
+        - Does this add a claim? If so, what observation would prove it false?
+        - Does this change a contract? If so, what currently-passing case
+          would break?
+      placeholder: |
+        - New claim: yes / no
+        - Falsified by: ...
+        - Breaking: yes / no
+    validations:
+      required: false

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,40 @@
+<!--
+This repo's thesis is that marketing claims should be falsifiable and evidence
+should be hash-verified. PRs are the human entry point to that pipeline, so
+they get the same shape: state the change, state how it could be wrong, state
+how to confirm it isn't.
+
+Delete sections that don't apply. Keep the headers you fill in.
+-->
+
+## Summary
+
+<!-- 1–3 sentences: what this PR changes and why. -->
+
+## Falsifiability check
+
+<!--
+The repo's thesis is falsifiable claims. Every PR should answer at least one of:
+
+- If a claim was added or changed: what evidence (URL + content hash) backs it,
+  and what observation would falsify it?
+- If a script or schema was changed: what input would have produced the wrong
+  answer before, and produces the right answer now?
+- If only docs / CI / chore: write "n/a — no claim or behavior change" and
+  explain briefly why.
+-->
+
+## Test plan
+
+<!--
+- [ ] `npm run fmt:check` passes
+- [ ] `npm run validate` passes
+- [ ] `npm test` passes (all suites)
+- [ ] `npm run lock:check` passes
+- [ ] CHANGELOG.md updated under `[Unreleased]` (or marked n/a)
+- [ ] Any new claim has hash-verified evidence (or marked aspirational)
+-->
+
+## Linked issues
+
+<!-- e.g., Closes #123, Refs #456. Delete if none. -->

.github/workflows/ci.yml

@@ -42,7 +42,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest]
-        node-version: ["22"]
+        node-version: ["20", "22"]
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
@@ -52,16 +52,42 @@ jobs:
           cache: npm
 
       - name: Install dependencies
-        run: npm ci
+        shell: bash
+        run: npm ci || (sleep 10 && npm ci)
 
       - name: Format check
-        run: npm run fmt:check
+        shell: bash
+        run: |
+          npm run fmt:check
+          echo "- Format check: passed (\`prettier --check .\`)" >> "$GITHUB_STEP_SUMMARY"
 
       - name: Schema + invariant validation
-        run: npm run validate
+        shell: bash
+        run: |
+          npm run validate
+          echo "- Schema + invariant validation: passed (\`marketing/scripts/validate.mjs\`)" >> "$GITHUB_STEP_SUMMARY"
 
       - name: Tests
-        run: npm test
+        shell: bash
+        run: |
+          npm test
+          echo "- Tests: passed (\`node --test\`)" >> "$GITHUB_STEP_SUMMARY"
 
       - name: Lockfile drift check
-        run: npm run lock:check
+        shell: bash
+        run: |
+          npm run lock:check
+          echo "- Lockfile drift check: passed (\`gen-lock.mjs --check\`)" >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Job summary header
+        if: always()
+        shell: bash
+        run: |
+          {
+            echo ""
+            echo "### CI matrix cell"
+            echo ""
+            echo "- OS: \`${{ matrix.os }}\`"
+            echo "- Node: \`${{ matrix.node-version }}\`"
+            echo "- Status: \`${{ job.status }}\`"
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/codeql.yml

@@ -3,14 +3,13 @@ name: CodeQL
 on:
   push:
     branches: [main]
-  pull_request:
-    branches: [main]
   schedule:
     - cron: "0 6 * * 1"
+  workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  cancel-in-progress: false
 
 permissions:
   contents: read