A small patch focused on CI hardening and a registry-trust fix.

CI and quality

All GitHub Actions are SHA-pinned, with a Renovate config to keep them current. (#68)
Code-quality and brand-boundary rules are now mechanized as lints. (#69)

Package manager

~/.npmrc is treated as user-trusted when running from the home directory, so a personal global config is honored rather than distrusted. (#72)

The adoption flow now offers to add a Nub skill to your coding agent's instructions, so the agent knows how to use Nub in your repo. (#55)

The full release notes list every change in this release.