fix(meta): PR #175 review round — all 14 findings addressed

H1 godot-cold-parse exit-code guard (+bonus: import-pass for cold checkouts, found live); H2 pr-watchlist-diff loud registry failure; H3/T1 deny list :* normalization (add-only) + uniform allow syntax; H4/T7 helper-script allows; H5 get_api_key env-only (config.json is tracked — no secret fallback); H6 TEAM.md active/standby split; H7 troblum solo-profiling note; H8 pr-review frontmatter Task->Agent; H9 conventions doc taxonomies fixed vs real tree; T2 ask-gate leash files (settings/hooks) in tracked settings; T3 R-013 cross-reference; T4 governance README index regenerated (pql decisions sync); T5 dudley briefing ACTIVE; T6 pr-process step 7 run-from-main.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tooling/godot-cold-parse

@@ -28,15 +28,50 @@ RUN_MENU=false
 
 rm -f "$REPO_ROOT/client/.godot/global_script_class_cache.cfg"
 
+# A truly cold checkout (fresh clone or worktree — .godot/ is gitignored) has
+# no resource-import cache, and every imported asset (fonts, ogg) then "fails
+# loading" during the parse run: a wall of false positives. Seed the cache
+# with an import pass first; source assets are tracked, so this is always
+# reconstructible. (Found live: first run in a fresh worktree, 2026-07-13.)
+if [ ! -d "$REPO_ROOT/client/.godot/imported" ] || [ -z "$(ls -A "$REPO_ROOT/client/.godot/imported" 2>/dev/null)" ]; then
+    echo "godot-cold-parse: no import cache — running one-time import pass..." >&2
+    set +e
+    IMPORT_OUT=$(godot --headless --path "$REPO_ROOT/client" --import 2>&1)
+    IMPORT_EXIT=$?
+    set -e
+    if [ "$IMPORT_EXIT" -ne 0 ]; then
+        echo "godot-cold-parse: import pass exited $IMPORT_EXIT" >&2
+        printf '%s\n' "$IMPORT_OUT" | tail -20 >&2
+        exit "$IMPORT_EXIT"
+    fi
+fi
+
 FILTER='^(SCRIPT )?ERROR|Parse Error|Export type'
 
-MATCHES=$(godot --headless --path "$REPO_ROOT/client" --quit 2>&1 \
+# Capture the godot run separately from the filter pipeline: with the
+# trailing `|| true` on the greps, a nonzero exit from godot itself (crash,
+# missing binary, corrupted install) would otherwise report "clean". Nothing
+# downstream re-reads the raw output now that this is scripted, so fail loud.
+set +e
+RAW=$(godot --headless --path "$REPO_ROOT/client" --quit 2>&1)
+GODOT_EXIT=$?
+set -e
+if [ "$GODOT_EXIT" -ne 0 ]; then
+    echo "godot-cold-parse: godot itself exited $GODOT_EXIT — not a parse verdict" >&2
+    printf '%s\n' "$RAW" | tail -20 >&2
+    exit "$GODOT_EXIT"
+fi
+
+MATCHES=$(printf '%s\n' "$RAW" \
   | grep -iE "$FILTER" \
   | grep -v "Failed loading resource: res://assets" \
   | grep -v "Cannot infer the type" \
   | grep -vE '(Messagepack|LocalBridge|ServerProcess|Constants)" not declared' || true)
 
 if [ "$RUN_MENU" = true ]; then
+    # Deliberately no exit-code check here: `timeout` kills the menu after
+    # 10s by design (exit 124 is the expected shutdown path); only the
+    # scraped error lines carry signal for this bounded run.
     MENU_MATCHES=$(timeout 10 godot --path "$REPO_ROOT/client" res://scenes/main_menu.tscn 2>&1 \
       | grep -iE "$FILTER" || true)
     if [ -n "$MENU_MATCHES" ]; then