[diegosouzapw]

Base-red repair for release/v3.8.51 — generated output and gate bookkeeping only, no behavior change.

Both reds below fail on every open PR targeting this branch and reproduce on a clean tip with
no local changes, so neither belongs to any feature branch.

1. check:agent-skills-sync — stale generated SKILL.md

Agent Skills Generator [dry-run]
Generated: 1 · Unchanged: 45 · GENERATED: + cli-mcp
(dry-run) No files written. Use --apply to write SKILL.md files.
##[error]Process completed with exit code 2.

The mcp enable / mcp disable CLI commands landed without their generated section being
regenerated. Fixed with node --import tsx/esm scripts/skills/generate-agent-skills.mjs --apply
— 20 added lines in skills/cli-mcp/SKILL.md, machine-generated from the command metadata
already on the base, nothing hand-written.

After: Generated: 0 · Unchanged: 46 · Pruned: 0 · Orphans: 0 · Errors: 0.

2. check:mutation-test-coverage --strict — unregistered covering tests

✗ 4 covering unit test(s) across 4 module(s) are missing from stryker.conf.json tap.testFiles.
  src/sse/services/auth.ts              + tests/unit/agnes-cn-provider.test.ts
  src/server/authz/routeGuard.ts        + tests/unit/mcp-restart-route-13012.test.ts
  open-sse/utils/error.ts               + tests/unit/antigravityUpstreamError.test.ts
  open-sse/services/combo/rrState.ts    + tests/unit/issue-13089-roundrobin-live-ws-events.test.ts

Four tests that cover mutated modules were never added to tap.testFiles, so their mutant kills
did not count and the strict gate stayed red. Fixed by registering them (428 entries, was 424).

After: ✓ No drift — every covering unit test is listed in tap.testFiles.

Note on scope drift while this PR was open

An earlier revision of this branch fixed the same two gates for omni-settings and one stryker
entry. Both were overtaken by merges into the base while the PR sat in the CI queue, so the
branch was merged up to the current tip and the fixes re-derived against it. The gate output
above is from the current head.

⚠️ Protected surface — operator approval required

This touches skills/**/SKILL.md, an agent-instruction surface. Content is generated, but per
the project rule it must not be merged autonomously.

3. check:docs-env-sync — env/docs contract out of sync

✗ In code but missing from .env.example: 1   — OMNIROUTE_CLOUD_SYNC_ENFORCE_SIGNATURE
✗ In .env.example but missing from ENVIRONMENT.md: 1 — CDP_PROXY_TOKEN

Both arrived with recently merged work and were never propagated across all three sources.

• OMNIROUTE_CLOUD_SYNC_ENFORCE_SIGNATURE (src/lib/cloudSync.ts:22) — documented in
  .env.example next to its OMNIROUTE_CLOUD_SYNC_* siblings and added to the Cloud Sync table
  in docs/reference/ENVIRONMENT.md. Default false, matching the source comment: OFF keeps
  v3.8.x back-compat, the default flips to enforced in v3.9.
• CDP_PROXY_TOKEN (docker/chatgpt-web-codex-browser/cdp-proxy.mjs:18) — already in
  .env.example, added to the ChatGPT Web (Codex) table in ENVIRONMENT.md. That table is
  written in German on the base; the new row matches its neighbours rather than introducing a
  second language mid-table.

After: ✓ Env / docs contract is in sync.