chore: file eight bug findings and stage four shared-asset proposals

Overnight hygiene sweep of this repo. Everything here is a finding or a staged proposal. No rule, workflow, script, or bundle file was modified.

The one that matters: the python and typescript language bundles ship no pre-commit hook, so a project installing either gets no credential scan on commit. Both bundles predate the hook rollout that swept go and bash, and install-lang skips missing components without a word, so it went unnoticed for two months. Live on two projects, one of them work. Filed [#A].

Seven more findings landed. The largest is a non-atomic write in the cross-project inbox tool, which can strand an empty handoff in another project's inbox and block a turn there. The rest are lint noise and two gaps in the Signal channel. An eighth was filed and then retracted the same night, once a retest showed I had compared two different files and read the difference as a bug.

Four proposals from other projects are staged under working/ with verified diffs, each behind a VERIFY task, waiting on a decision.

1 files changed, 19 insertions, 0 deletions

diff --git a/working/wrapup-temp-cleanup/proposed.diff b/working/wrapup-temp-cleanup/proposed.diff
new file mode 100644
index 0000000..5c2375c
--- /dev/null
+++ b/working/wrapup-temp-cleanup/proposed.diff
@@ -0,0 +1,19 @@
+--- claude-templates/.ai/workflows/wrap-it-up.org	2026-07-19 21:07:49.848788027 -0500
++++ /tmp/wu.org	2026-07-23 02:48:49.759571128 -0500
+@@ -189,6 +189,16 @@
+ emacs --batch -q -l .ai/scripts/todo-cleanup.el --archive-done --check todo.org
+ #+end_src
+ 
++*** Clear temp/
++
++#+begin_src bash
++[ -d temp ] && find temp -mindepth 1 -delete && echo "temp/ cleared"
++#+end_src
++
++=temp/= holds throwaway artifacts — discarded prototypes, scratch output, intermediate data (see =working-files.md=). It's gitignored in every project, so nothing here rides a commit and nothing is recoverable from git once deleted. Clearing it at wrap is what keeps ephemeral work from silting up across sessions, and it's the counterpart to =working/=, which is tracked and *never* cleared here.
++
++Two guards. Confirm before deleting if =temp/= holds anything a reasonable reader would call in-progress rather than throwaway — misfiled work belongs in =working/=, so move it there instead of deleting it. And skip the step entirely in a project where =temp/= is not gitignored, since that means the project is using the directory for something else.
++
+ *** Sync child priorities
+ 
+ #+begin_src bash