[Number531]

The public repository's onboarding mixed installed-plugin and checkout instructions, and its documentation still described private access and unavailable security features. This change separates setup routes, explains project and hook trust, and aligns community access, owner-controlled writes, issue reporting and private vulnerability reporting with the current GitHub settings.

The 0.2.1 candidate also adds offline documentation checks to CI, regressions for broken links/anchors and invalid JSON/TOML examples, and release/rollback guidance. Runtime assets, setup, guard logic, skills, agent names and model pins are unchanged. Delegation enforcement stays off by default.

Validation:

• 54 unit tests, catalog consistency, 49 local Markdown references, four JSON/TOML examples and whitespace checks passed. Official plugin validation passed for the unchanged manifests. Independent verification covers the original preparation and the subsequent public-state documentation changes.
• CLI 0.154.0 and Desktop engine 0.154.0-alpha.6.2 installed the local candidate and exact GitHub commit 1ea514efdacb8aa1077e4eb81a8f7d90d1255306 into disposable configuration/cache. All 30 package files matched, three skills were present, setup was idempotent, and the guard stayed off. No auth files were copied, hook trust granted or live models called. Later edits are documentation-only.
• Repository and Issues access were verified without authentication. Private vulnerability reporting, secret scanning and push protection are enabled. Main requires PRs, the GitHub Actions contracts check and resolved conversations; administrators are included and force-push/deletion are blocked.
• The owner is the only currently listed user with write/admin access. Public issue reports and proposed PRs do not confer write permission.

Remaining release boundaries are explicit: the owner has not selected a distribution license, Desktop UI and separate-account/live-model qualification remain open, and a tag/GitHub release requires its own publication decision. This documentation merge does not adopt a license or publish a versioned release. No real global plugin installation or global configuration change occurred.