[0kim0bos]

Summary

• Use bounded hash-only turn baselines rather than pre-existing dirty scope.
• Keep ordinary reporting advisory; preserve strict risky-work and independent security gates.
• Exclude known generated outputs with include precedence; support bold report titles and concise missing-field prompts.
• Bump package, lock and manifest to 2.8.3; renew identified source review and local runtime pins.

Verification

• Full verify:self, packaged CLI, typecheck, package boundary and unpublished-version registry check passed.
• Exact staged-tree, outgoing-commit and CI-context security evidence gates passed locally; protected hosted CI must independently pass.
• Actual Codex host execution and SEC-05 production publishing environment remain unverified.

Release boundary

• npm publication is performed by the user, not by this PR operation.
• Preserve required review, Code Owner review, required Security check and administrator enforcement.