fix: resolve 25 pre-publish blockers

- postinstall.mjs: fix alias package detection
- migrate-legacy-plugin-entry: dedupe + regression tests
- task_system: default consistency across runtime paths
- task() contract: consistent tool behavior
- runtime model selection, tool cap, stale-task cancellation
- recovery sanitization, context-limit gating
- Ralph semantic DONE hardening, Atlas fallback persistence
- native-skill description/content, skill path traversal guard
- publish workflow: platform awaited via reusable workflow job
- release: version edits reapplied before commit/tag
- JSONC plugin migration: top-level plugin key safety
- cold-cache: user fallback models skip disconnected providers
- docs/version/release framing updates

Verified: bun test (4599 pass), tsc --noEmit clean, bun run build clean

src/plugin-handlers/tool-config-handler.test.ts

@@ -15,7 +15,7 @@ function createParams(overrides: {
   return {
     config: { tools: {}, permission: {} } as Record<string, unknown>,
     pluginConfig: {
-      experimental: { task_system: overrides.taskSystem ?? false },
+      experimental: overrides.taskSystem === undefined ? undefined : { task_system: overrides.taskSystem },
       disabled_tools: overrides.disabledTools,
     } as OhMyOpenCodeConfig,
     agentResult: agentResult as Record<string, unknown>,
@@ -216,6 +216,30 @@ describe("applyToolConfig", () => {
     })
   })
 
+  describe("#given task_system is undefined", () => {
+    describe("#when applying tool config", () => {
+      it.each([
+        "atlas",
+        "sisyphus",
+        "hephaestus",
+        "prometheus",
+        "sisyphus-junior",
+      ])("#then should deny todo tools for %s agent by default", (agentName) => {
+        const params = createParams({
+          agents: [agentName],
+        })
+
+        applyToolConfig(params)
+
+        const agent = params.agentResult[agentName] as {
+          permission: Record<string, unknown>
+        }
+        expect(agent.permission.todowrite).toBe("deny")
+        expect(agent.permission.todoread).toBe("deny")
+      })
+    })
+  })
+
   describe("#given disabled_tools includes 'question'", () => {
     let originalConfigContent: string | undefined
     let originalCliRunMode: string | undefined