…attern (Phase 6b) (#60)

* feat(0.21.7): bstack skills graduate — crystallize Tier-2 migration pattern (Phase 6b)

New `bstack skills graduate <name>` subcommand automating the skill-graduation
pattern that ran 8 times manually on 2026-05-25/26 (Phases 2-4f). P16
crystallization — rule-of-three exceeded ~8x.

## What it does

Automates: clone source + monorepo → copy canonical content (excl. .git,
dot-mirror dirs, LICENSE, skills-lock.json) → append README Tier-2 row →
commit + push + PR on monorepo → (--stub) redirect-stub PR on source →
(--merge) merge → cleanup. Registry update is printed (copy-paste), not
auto-applied (needs coordinated version bump review).

## Files

- NEW scripts/skill-graduate.sh (~230 lines) — the engine; env-overridable
  gh/git/tmpdir/dry-run hooks for hermetic testing
- NEW tests/skill-graduate.test.sh — 9 offline tests (arg-parse, dry-run,
  rename detection, stub-gh/git execution with copy+exclude verification,
  no-SKILL.md error path). All 9 pass.
- CHANGED bin/bstack-skills — graduate) dispatch + usage
- CHANGED bin/bstack — top-level usage entry
- VERSION 0.21.6 → 0.21.7

## Validation (P11)

- 9/9 hermetic tests pass (offline, stub gh/git)
- dry-run verified against real skill names (rename detection: omnivoice-skill → omnivoice)
- top-level dispatch `bstack skills graduate --help` routes correctly
- invalid-name + missing-name + unknown-option all exit 2; no-SKILL.md exits 1

## Provenance

8 manual instances: broomva/skills PRs #2-#9 + broomva/bstack PRs #53-#59.
The next graduation is one command instead of a full manual cycle.

* fix(p20-round-1): address cross-review blockers on skill-graduate CLI

P20 cross-review (Strata B) returned NEEDS-WORK (7/10) with 2 blockers +
2 nits + a test-coverage gap. All addressed:

1. [BLOCKER] Word-splitting in copy loop — `for item in $(ls -A)` broke on
   spaced/globbed filenames (reproduced by reviewer; aborts under set -e
   mid-copy). Replaced with null-delimited `find -print0 | while read -d ''`.

2. [BLOCKER] Header lie — step 3 claimed "Append a row to the monorepo
   README Tier-2 table" but no such code existed. Removed the false claim;
   README row is now correctly documented as a printed manual follow-up
   (alongside the registry entry), since category placement needs judgment.

3. [idempotency] Re-run safety — added a pre-flight `gh pr list --head`
   check that bails cleanly if an open PR for the branch already exists,
   instead of failing opaquely inside the push/PR subshell on the 2nd run.

4. [merge masking] `--merge` no longer swallows genuine merge failures —
   captures the dual-attempt result and WARNs (red CI / conflicts / gate)
   instead of `|| true` blackholing.

5. [test gap] T8 now inspects the COPIED TREE (asserts references/ + scripts/
   present, .claude/ + LICENSE + skills-lock.json absent) via the new
   BSTACK_GRADUATE_NO_CLEANUP test hook — previously only checked exit code.
   Added T10: spaced/globbed-filename regression test (the exact gap that
   let blocker #1 through a green suite). 9 → 10 tests, all pass.

Validation: 10/10 hermetic tests pass. T10 fails against the pre-fix loop
(confirmed the regression guard is real).

* fix(p20-round-2): surface stub-merge failures too (consistency with monorepo path)

Residual nit from P20 round-2 re-review (verdict PASS 9/10): the source
redirect-stub merge still had `|| true`, asymmetric with the monorepo
path's fix. Now warns on genuine merge failure instead of swallowing.
Cosmetic — low-stakes (redirect stub, not canonical content) — but closes
the asymmetry the reviewer flagged. 10/10 tests still pass.