chore(#518): rename npm package + bin to @opengsd/gsd-core (#519)

* chore: rename npm package + bin to @opengsd/gsd-core (functional)

- package.json: name @opengsd/get-shit-done-redux → @opengsd/gsd-core,
  bin key get-shit-done-redux → gsd-core, repository/homepage/bugs URLs
- package-lock.json: regenerated (npm install --package-lock-only)
- tests/**, scripts/**, bin/**, .github/**, agents/**, commands/**,
  get-shit-done/bin/**, get-shit-done/workflows/**:
  applied the 4-rule replacement (scoped npm ref, GitHub repo path,
  bin/clone invocations) per #505 single-source refactor

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs: sweep live references to @opengsd/gsd-core

Update all live documentation (README.md + translations, docs/**,
CONTRIBUTING.md, VERSIONING.md, SECURITY.md, CONTEXT.md,
docs/CANARY.md) to reflect the renamed package and repository.

Rules applied:
- @opengsd/get-shit-done-redux → @opengsd/gsd-core (scoped npm name)
- open-gsd/get-shit-done-redux → open-gsd/gsd-core (GitHub repo)
- GSD-redux/get-shit-done-redux → open-gsd/gsd-core (stale badge org)
- bare bin/clone refs → gsd-core

CHANGELOG.md, docs/adr/**, docs/RELEASE-*.md, docs/research/**,
and .changeset/** are preserved byte-identical.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix: add negative lookbehind to slash-command regex in bug-2954 test

The extractSlashReferences regex matched /gsd-core inside npm package
URLs (@opengsd/gsd-core), producing a false /gsd:core command reference.
Adding a negative lookbehind (?<![a-z]) excludes matches preceded by a
letter, so only standalone /gsd-<cmd> and /gsd:<cmd> tokens are found.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(#518): add changeset for package rename

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* test(#518): update package-identity expectations to the renamed coordinates

The rebase regenerated the seam to @opengsd/gsd-core (bin gsd-core, repo
open-gsd/gsd-core). The #498 seam tests assert deriveIdentity against the REAL
package.json, so their expected literals must follow the rename. The drift-lint
unit test is left as-is — its SEAM is a self-consistent fixture and its
stale-literal detection cases would shift if altered; the live-repo scan in it
already passes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

bin/install.js

@@ -8624,7 +8624,7 @@ function install(isGlobal, runtime = 'claude', options = {}) {
   // behind by a previous version), there is no actual "user choice" to
   // make — the file is a known GSD-managed artifact and the installer is
   // about to write the fresh bundled version. Gating the resolver on
-  // `!isTTY` made `npx @opengsd/get-shit-done-redux@latest --codex` hard-abort with
+  // `!isTTY` made `npx @opengsd/gsd-core@latest --codex` hard-abort with
   // 12 blocked bundled hooks. The env-override branch (operator-supplied
   // GSD_INSTALLER_MIGRATION_RESOLVE) still applies only in non-TTY mode.
   const _migrationIsTty = process.stdin && process.stdin.isTTY === true;
@@ -8863,7 +8863,7 @@ function install(isGlobal, runtime = 'claude', options = {}) {
   // Copy agents to agents directory.
   // Skipped under --minimal: gsd-* subagent descriptions are eagerly loaded
   // into the runtime's Agent tool schema, costing ~6k tokens per turn even
-  // when no GSD workflow is active. See open-gsd/get-shit-done-redux#2762.
+  // when no GSD workflow is active. See open-gsd/gsd-core#2762.
   // Note: agentsSrc is declared as let before the enclosing try block so it
   // is accessible by installCodexConfig() in the Codex config section below.
   agentsSrc = _stageAgents(path.join(src, 'agents'));
@@ -10694,12 +10694,12 @@ function maybeSuggestPathExport(globalBin, homeDir) {
 
 /**
  * #3406 helper: detect a stale globally-installed `@opengsd/gsd-sdk` package
- * shadowing the `gsd-sdk` shim that `@opengsd/get-shit-done-redux` installs.
+ * shadowing the `gsd-sdk` shim that `@opengsd/gsd-core` installs.
  *
  * Background: `@opengsd/gsd-sdk@0.1.0` was published once and never updated
- * (the SDK now ships embedded in `@opengsd/get-shit-done-redux`). When a user has the
+ * (the SDK now ships embedded in `@opengsd/gsd-core`). When a user has the
  * 0.1.0 standalone package installed globally, its `gsd-sdk` bin shadows
- * the one `@opengsd/get-shit-done-redux` provides — and the 0.1.0 binary only knows
+ * the one `@opengsd/gsd-core` provides — and the 0.1.0 binary only knows
  * `run | auto | init` (no `query`), so every `gsd-sdk query <command>`
  * call from skills/hooks fails until the user runs
  * `npm uninstall -g @opengsd/gsd-sdk`.
@@ -10762,7 +10762,7 @@ function formatStaleStandaloneSdkWarning(info) {
     '     npm uninstall -g @opengsd/gsd-sdk',
     '     npx -y ' + pkg.name + '@latest --<runtime> --global',
     '',
-    '   Tracking: #3406 — https://github.com/open-gsd/get-shit-done-redux/issues/3406',
+    '   Tracking: #3406 — https://github.com/open-gsd/gsd-core/issues/3406',
   ].join('\n');
 }