Add insights-context skill with cross-referenced friction resolution

[RasputinKaiser]

Summary

Adds a new user-installed skill, /insights-context, that produces a context-aware HTML insights report mirroring the bundled /insights command, but cross-references friction signals against git history + auto-memory so resolved issues are not reported as currently broken.

The skill ships three project-agnostic Python scripts under skills/insights-context/scripts/:

• scan.py — walks NCode session JSONLs into friction + stats JSON
• resolve.py — builds resolved + environmental ledger from memory files and git log
• render.py — cross-references scan output against the resolved ledger, emits a standalone HTML report
• compare.py — delta view between two scan windows (for --compare)
• test_smoke.py — end-to-end fixture test with zero-identity-leak assertions

Classifier

The resolver matches friction topics to resolved entries using signal-based keys (file paths, commit hashes, code symbols) with three confidence tiers:

• Match + friction before fix date → RESOLVED (suppressed from At a Glance)
• Match + friction after fix date → REGRESSION (flagged in red)
• Match + environmental marker → ENVIRONMENTAL (routed to a separate section)
• No match → OPEN

Informational interrupts (user adds context or preference mid-task) are tracked separately from friction so they don't inflate the friction count.

Redaction

All paths and snippets are scrubbed before emission: home directory → ~, bare username → <redacted>, API keys / tokens / Artifactory URLs / basic-auth URLs → <redacted-*>, GitHub noreply emails (12345+handle@users.noreply.github.com) → <redacted-github-email>, /users/<numeric-id> profile URLs → <redacted-github-url>. Optional per-user tokens load from ~/.ncode/identity-redact.txt.

Latest commit — bug fixes from deep review

The third commit (8ce23ad) fixes correctness, redaction, and test-isolation issues found in a focused review of the scripts:

• render.py — classifier no longer breaks on first match. It iterates all resolved entries and prefers ones with a real fixed_at so an undated early match cannot shadow a later dated entry (restoring the documented "Match + friction before fix → RESOLVED" invariant).
• resolve.py — fixed_at now picks dates anchored to fix keywords (fixed/resolved/patched/landed/merged/shipped) in prose over naive last-position, so "originally seen X, fixed Y" picks the right date. Git-log parser handles empty commit bodies (4-field split no longer rejected).
• scan.py — parse_ts normalizes tz-aware timestamps to naive UTC so mixed aware/naive streams no longer crash on subtraction. is_err filters negated forms ("no error", "error: none") and word-bounds the error: marker. Added a bare-token secret redaction pattern catching values like api_key abc123... that the =/: form misses. OTHER_USERS_RE also scrubs /home/<name>/ on Linux.
• render.py — open subprocess is cross-platform (xdg-open on Linux, open on macOS).
• test_smoke.py — synthesizes its own temp git repo with a baseline + fix commit touching OnDemandVerificationStore.swift, dated after the fixture friction, so the RESOLVED assertion exercises a real classifier path instead of relying on the host repo happening to contain that file. Removes lstrip("-") so the memory-dir path keeps its leading dash.

Test plan

• python3 test_smoke.py passes end-to-end (scan → resolve → render → leak scan)
• Live /insights-context run on this repo: 13 sessions scanned, 9 OPEN / 1 RESOLVED / 0 REGRESSIONS, zero identity leaks in rendered HTML
• All scripts pass python3 -c "import ast; [ast.parse(open(f).read()) for f in [...]]"
• Leak check: grep -iE "noreply.github|/users/[0-9]" /tmp/insights-context-*.html returns zero matches

Notes

• This is a user-installed skill living under skills/. It does not modify any core CLI code, build, or test path. Default bun install && bun run build is unaffected.
• All scripts are project-agnostic — paths are derived from cwd/argv, none are hardcoded.
• No new dependencies. Python 3 stdlib only.