fix stale docs, simplify CLI, add MCP write tools, improve dashboard UX

[CodeWithJuber]

Wave 1 — Fix what's broken/stale:

• ROADMAP.md: update version references to v0.8.0, add shipped v0.7.0 section
• landing/index.html: update test count (438→471) and tool count (9→14)
• templates/project-layer/CLAUDE.md: genericize (remove Hostlelo-specific references)
• CLAUDE.md: add contributor instructions for forgekit itself
• Deduplicate skills/: update .codex-plugin skills path to global/tools, remove duplicate skills/ directory, remove from package.json files array
• src/init.js: fix double-hook detection in mergeHooks() — extract guard basename for dedup so plugin-style and settings-style paths don't duplicate
• Regenerate public/index.html via build-pages.mjs
• Fix pre-existing biome template literal warnings across src/ and test/

Wave 2 — Simplify UX:

• src/cli.js: group 29 CLI commands into 5 categories (Core, Memory, Substrate, Quality, Config) in help output with "Start here: forge catalog" footer
• src/cortex_mcp.js: add 4 MCP tools (forge_remember, forge_ledger_ratify, forge_ledger_retract, forge_dash_summary) so agents can write back to memory and do lightweight health checks — MCP surface now 19 tools

Wave 3 — Dashboard + landing polish:

• src/dash.html: add empty-state guidance for spend panel, recent events, and cost stats when .forge/ is empty
• src/dash.js: add dashSummary() for lightweight counts-only dashboard queries
• Landing page audit: no remaining stale version or count references

Claude-Session: https://claude.ai/code/session_019PXuKmJp92Gdo2FudNjSx2

What & why

Checklist

• npm test passes (Node 18/20/22)
• npm run check passes (Biome lint + format)
• New public functions have a test
• Conventional commit message (feat:/fix:/docs: …)
• CHANGELOG.md updated under ## [Unreleased]
• No new runtime dependency (dev deps ok)
• Substrate/docs updated if this changes forge substrate, forge impact, router/gate, or MCP substrate tools

Risk & rollback

• Risk level: low / medium / high
• Rollback plan:

Extra checks (tick if applicable)

• npm run typecheck passes
• Input validated at boundaries; errors handled (no swallowing)
• Authorization/ownership checked (if it touches access)
• Logs contain no secrets/PII
• If AI-assisted: I understand it, verified the package APIs, and it has tests