v0.8.2: cleanup + prose + structure + decomposition + budget + errors

Phase 1 — dedup + hardening (~9 items):
- Remove duplicate *skill-registry* defvar from core-skills
- Merge *backend-registry* into *probabilistic-backends*, delete backend-register
- Remove inject-stimulus alias, standardize on stimulus-inject
- Add pre-eval sandbox (skill-source-scan) blocks restricted symbols before eval
- Remove dead plist-get function; remove duplicate json-alist-to-plist export
- Fix read-framed-message whitespace DoS (4096-iteration max)
- Add *read-eval* nil to dispatcher-approvals-process read-from-string (RCE)
- Add test-op to ASDF; update .asd version 0.4.3→0.7.2

Phase 2 — prose + contracts + reorder:
- Split ROADMAP: 2623→1089 lines (TODO only), CHANGELOG: 260→1528 lines (full DONE history, 14 versions reverse chron)
- Add Contracts + Overview to 6 channel files + embedding-native + programming-standards + symbolic-scope
- Reorder 28 .org files: Contract → Test Suite → Implementation (TDD order)
- Add 7-phase inline prose to think() in core-reason
- Expand USER_MANUAL: 183→461 lines (10 new sections)

Phase 3 — decomposition + export organization:
- Decompose think() into think-assemble-prompt, think-call-llm, think-parse-response orchestrator
- Organize 188 exports into 16 grouped sections by module

Phase 4 — budget enforcement + error protocol:
- Per-session budget enforcement (SESSION_BUDGET_USD env var, budget-exhausted-p, guard in think-call-llm)
- Error condition hierarchy (6 conditions: pipeline-error, llm-error, gate-error, budget-error, protocol-error)
- Restarts in loop-process: skip-signal, use-fallback, abort-pipeline

lisp/security-vault.lisp

@@ -1,39 +1,3 @@
-(in-package :passepartout)
-
-(defvar *vault-memory* (make-hash-table :test 'equal)
-  "In-memory cache of sensitive credentials.")
-
-(defun vault-get (provider &key (type :api-key))
-  "Retrieves a credential from the vault or environment."
-  (let* ((key (format nil "~a-~a" provider type))
-         (val (gethash key *vault-memory*)))
-    (if val
-        val
-        (let ((env-var (case provider
-                          (:gemini "GEMINI_API_KEY")
-                          (:openai "OPENAI_API_KEY")
-                          (:anthropic "ANTHROPIC_API_KEY")
-                          (:openrouter "OPENROUTER_API_KEY")
-                          (otherwise nil))))
-          (when env-var (uiop:getenv env-var))))))
-
-(defun vault-set (provider secret &key (type :api-key))
-  "Stores a secret in the vault."
-  (let ((key (format nil "~a-~a" provider type)))
-    (setf (gethash key *vault-memory*) secret)))
-
-(defun vault-get-secret (provider)
-  "Retrieves a stored secret or token for a gateway provider."
-  (vault-get provider :type :secret))
-
-(defun vault-set-secret (provider secret)
-  "Stores a secret or token for a gateway provider."
-  (vault-set provider secret :type :secret))
-
-(defskill :passepartout-security-vault
-  :priority 600
-  :trigger (lambda (ctx) (declare (ignore ctx)) nil))
-
 (eval-when (:compile-toplevel :load-toplevel :execute)
   (ql:quickload :fiveam :silent t))
 
@@ -84,3 +48,39 @@
   (is (string= "secret-value" (vault-get :vault-type-test :type :secret)))
   (vault-set :vault-type-test nil :type :api-key)
   (vault-set :vault-type-test nil :type :secret))
+
+(in-package :passepartout)
+
+(defvar *vault-memory* (make-hash-table :test 'equal)
+  "In-memory cache of sensitive credentials.")
+
+(defun vault-get (provider &key (type :api-key))
+  "Retrieves a credential from the vault or environment."
+  (let* ((key (format nil "~a-~a" provider type))
+         (val (gethash key *vault-memory*)))
+    (if val
+        val
+        (let ((env-var (case provider
+                          (:gemini "GEMINI_API_KEY")
+                          (:openai "OPENAI_API_KEY")
+                          (:anthropic "ANTHROPIC_API_KEY")
+                          (:openrouter "OPENROUTER_API_KEY")
+                          (otherwise nil))))
+          (when env-var (uiop:getenv env-var))))))
+
+(defun vault-set (provider secret &key (type :api-key))
+  "Stores a secret in the vault."
+  (let ((key (format nil "~a-~a" provider type)))
+    (setf (gethash key *vault-memory*) secret)))
+
+(defun vault-get-secret (provider)
+  "Retrieves a stored secret or token for a gateway provider."
+  (vault-get provider :type :secret))
+
+(defun vault-set-secret (provider secret)
+  "Stores a secret or token for a gateway provider."
+  (vault-set provider secret :type :secret))
+
+(defskill :passepartout-security-vault
+  :priority 600
+  :trigger (lambda (ctx) (declare (ignore ctx)) nil))