v0.2.1: polish, deploy, CI, and literate refactor

- Secret Exposure Gate + Privacy Filter (Bouncer)
- Shell actuator safety harness (timeout, blocked patterns)
- REPL-first enforcement (lisp validation gate, system-prompt-augment)
- Engineering Standards lifecycle (two-track Org-first + REPL-first)
- Literate Programming discipline (one function per block, reflect-back)
- AGENTS.md: thin routing layer, skills are authoritative
- SKILLS_DIR removed, ~/notes fallback eliminated
- opencortex.sh: multi-distro (Debian+Fedora), configure, install service, backup, restore, help
- infrastructure/opencortex.service (systemd user unit)
- Docker: updated to debian:trixie, fixed build context
- GitHub CI: lint + test workflows fixed, trigger on tags only
- Gitea CI: deploy workflow paths fixed
- README: one-line curl install, badges
- USER_MANUAL: Deployment section (bare metal, Docker, backup)
- .gitignore: skills/*.lisp and tests/*.lisp as generated artifacts
- Prose/block refactor across all 35 org files
- Test suite Tier 1: 43/45 pass (env-dependent failures isolated)

harness/doctor.org

@@ -48,13 +48,13 @@ Common Lisp's `getenv` is strictly typed in SBCL. The Doctor must ensure that mi
 (test test-env-validation-fail
   "Verify that an invalid MEMEX_DIR triggers a critical failure."
   (let ((old-m (uiop:getenv "MEMEX_DIR"))
-        (old-s (uiop:getenv "SKILLS_DIR")))
+        (old-d (uiop:getenv "OC_DATA_DIR")))
     (unwind-protect
          (progn
            (setf (uiop:getenv "MEMEX_DIR") "/non/existent/path/999")
            (is (null (opencortex:doctor-check-env))))
       (setf (uiop:getenv "MEMEX_DIR") (or old-m ""))
-      (setf (uiop:getenv "SKILLS_DIR") (or old-s "")))))
+      (setf (uiop:getenv "OC_DATA_DIR") (or old-d "")))))
 #+end_src
 
 * Phase C: Implementation (Build)