release: v5.0.0-rc.2

[telagod]

Release v5.0.0-rc.2

Changes

• Security skills streamlined to red-team-first tone — removed repeated authorization disclaimers from securing-systems, defending-applications, and their references/; the kernel scope.md remains the single authorization gate, so exec skills no longer re-trigger it.
• Codex TOML editor hardened — array-of-table headers ([[...]]), multi-line strings, and hook/MCP headers with trailing whitespace are now parsed correctly; duplicate ABYSS_HOOK_MARKER constant unified with bin/lib/abyss-integration.js.
• doctor / compose runtime fixes — doctor no longer reports missing inject plane for Gemini/OpenClaw; compose rejects unsupported targets and refuses to write guidance over the 8000-char budget cap.
• Skill script path safety — doc_generator, persona_forge, and scanner skills now resolve user-supplied paths through resolveSafePath to prevent symlink/traversal surprises.
• run_skill.js lock hardened — lock directory moved from world-writable os.tmpdir() to ~/.code-abyss/locks/, uses atomic directory creation, and includes the skill name in the lock hash to avoid cross-skill contention.

Validation

• npm test: 43 suites / 489 passed / 2 skipped
• npm run verify:skills: 39 skills + 7 personas
• npm run packs:check: passed
• security_scanner.js: 0 critical/high/medium/low

Next steps

• Merge this PR after CI green (15 jobs)
• git tag v5.0.0-rc.2 && git push origin v5.0.0-rc.2
• gh release create v5.0.0-rc.2 --title "v5.0.0-rc.2" --notes "..." — triggers release.yml → npm publish

Do not run npm publish manually.