v0.8.2: cleanup + prose + structure + decomposition + budget + errors

Phase 1 — dedup + hardening (~9 items):
- Remove duplicate *skill-registry* defvar from core-skills
- Merge *backend-registry* into *probabilistic-backends*, delete backend-register
- Remove inject-stimulus alias, standardize on stimulus-inject
- Add pre-eval sandbox (skill-source-scan) blocks restricted symbols before eval
- Remove dead plist-get function; remove duplicate json-alist-to-plist export
- Fix read-framed-message whitespace DoS (4096-iteration max)
- Add *read-eval* nil to dispatcher-approvals-process read-from-string (RCE)
- Add test-op to ASDF; update .asd version 0.4.3→0.7.2

Phase 2 — prose + contracts + reorder:
- Split ROADMAP: 2623→1089 lines (TODO only), CHANGELOG: 260→1528 lines (full DONE history, 14 versions reverse chron)
- Add Contracts + Overview to 6 channel files + embedding-native + programming-standards + symbolic-scope
- Reorder 28 .org files: Contract → Test Suite → Implementation (TDD order)
- Add 7-phase inline prose to think() in core-reason
- Expand USER_MANUAL: 183→461 lines (10 new sections)

Phase 3 — decomposition + export organization:
- Decompose think() into think-assemble-prompt, think-call-llm, think-parse-response orchestrator
- Organize 188 exports into 16 grouped sections by module

Phase 4 — budget enforcement + error protocol:
- Per-session budget enforcement (SESSION_BUDGET_USD env var, budget-exhausted-p, guard in think-call-llm)
- Error condition hierarchy (6 conditions: pipeline-error, llm-error, gate-error, budget-error, protocol-error)
- Restarts in loop-process: skip-signal, use-fallback, abort-pipeline

org/security-vault.org

@@ -35,6 +35,61 @@ through here.
 - Does NOT validate key format — the provider skill does that.
 - Does NOT rotate or expire keys — this is a simple store.
 
+* Test Suite
+
+#+begin_src lisp
+(eval-when (:compile-toplevel :load-toplevel :execute)
+  (ql:quickload :fiveam :silent t))
+
+(defpackage :passepartout-security-vault-tests
+  (:use :cl :fiveam :passepartout)
+  (:export #:vault-suite))
+
+(in-package :passepartout-security-vault-tests)
+
+(def-suite vault-suite :description "Verification of the Credentials Vault")
+(in-suite vault-suite)
+
+(test test-vault-round-trip
+  "Contract 1: vault-set stores a value; vault-get retrieves it."
+  (let ((test-key :vault-test-round-trip)
+        (test-secret "secret-abc123"))
+    (vault-set test-key test-secret)
+    (is (string= test-secret (vault-get test-key)))
+    ;; Clean up
+    (vault-set test-key nil)))
+
+(test test-vault-missing-key
+  "Contract 2: vault-get returns NIL for an unset, unknown provider."
+  (is (null (vault-get :nonexistent-provider-xyz))))
+
+(test test-vault-isolation
+  "Contract 5: storing for provider A does not affect provider B."
+  (vault-set :vault-prov-a "secret-a")
+  (vault-set :vault-prov-b "secret-b")
+  (is (string= "secret-a" (vault-get :vault-prov-a)))
+  (is (string= "secret-b" (vault-get :vault-prov-b)))
+  (vault-set :vault-prov-a nil)
+  (vault-set :vault-prov-b nil))
+
+(test test-vault-secret-wrappers
+  "Contracts 3,4: vault-get-secret and vault-set-secret use :type :secret."
+  (let ((test-provider :vault-secret-test))
+    (vault-set-secret test-provider "my-token")
+    (is (string= "my-token" (vault-get-secret test-provider)))
+    ;; Clean up
+    (vault-set-secret test-provider nil)))
+
+(test test-vault-type-isolation
+  "Contract 5: different :type values produce different keys."
+  (vault-set :vault-type-test "key-value" :type :api-key)
+  (vault-set :vault-type-test "secret-value" :type :secret)
+  (is (string= "key-value" (vault-get :vault-type-test :type :api-key)))
+  (is (string= "secret-value" (vault-get :vault-type-test :type :secret)))
+  (vault-set :vault-type-test nil :type :api-key)
+  (vault-set :vault-type-test nil :type :secret))
+#+end_src
+
 * Implementation
 
 ** Package Context
@@ -103,57 +158,3 @@ Delegates to the existing =vault-get=/=vault-set= with ~:type :secret~.
   :trigger (lambda (ctx) (declare (ignore ctx)) nil))
 #+end_src
 
-* Test Suite
-
-#+begin_src lisp
-(eval-when (:compile-toplevel :load-toplevel :execute)
-  (ql:quickload :fiveam :silent t))
-
-(defpackage :passepartout-security-vault-tests
-  (:use :cl :fiveam :passepartout)
-  (:export #:vault-suite))
-
-(in-package :passepartout-security-vault-tests)
-
-(def-suite vault-suite :description "Verification of the Credentials Vault")
-(in-suite vault-suite)
-
-(test test-vault-round-trip
-  "Contract 1: vault-set stores a value; vault-get retrieves it."
-  (let ((test-key :vault-test-round-trip)
-        (test-secret "secret-abc123"))
-    (vault-set test-key test-secret)
-    (is (string= test-secret (vault-get test-key)))
-    ;; Clean up
-    (vault-set test-key nil)))
-
-(test test-vault-missing-key
-  "Contract 2: vault-get returns NIL for an unset, unknown provider."
-  (is (null (vault-get :nonexistent-provider-xyz))))
-
-(test test-vault-isolation
-  "Contract 5: storing for provider A does not affect provider B."
-  (vault-set :vault-prov-a "secret-a")
-  (vault-set :vault-prov-b "secret-b")
-  (is (string= "secret-a" (vault-get :vault-prov-a)))
-  (is (string= "secret-b" (vault-get :vault-prov-b)))
-  (vault-set :vault-prov-a nil)
-  (vault-set :vault-prov-b nil))
-
-(test test-vault-secret-wrappers
-  "Contracts 3,4: vault-get-secret and vault-set-secret use :type :secret."
-  (let ((test-provider :vault-secret-test))
-    (vault-set-secret test-provider "my-token")
-    (is (string= "my-token" (vault-get-secret test-provider)))
-    ;; Clean up
-    (vault-set-secret test-provider nil)))
-
-(test test-vault-type-isolation
-  "Contract 5: different :type values produce different keys."
-  (vault-set :vault-type-test "key-value" :type :api-key)
-  (vault-set :vault-type-test "secret-value" :type :secret)
-  (is (string= "key-value" (vault-get :vault-type-test :type :api-key)))
-  (is (string= "secret-value" (vault-get :vault-type-test :type :secret)))
-  (vault-set :vault-type-test nil :type :api-key)
-  (vault-set :vault-type-test nil :type :secret))
-#+end_src