1.0: real depth-layer scanners for Apex, Spine, Cortex, and Forge

Depth layers

• -Apex: health_aggregator.py runs Warden, Forge, Cortex, and Spine scans in parallel via ThreadPoolExecutor and merges findings into a unified AgentReport. dependency_graph.py AST-walks every Python script under team/*/scripts/, detects circular imports via DFS, and flags unused internal modules. Entry point apex_scan.py writes .reports/apex-<ts>.json and exits 2 on CRITICAL or HIGH findings.
• -Spine: n_plus_one_detector.py statically detects ORM query patterns inside loops, raw SQL in loops, and string-formatted SQL. endpoint_profiler.py times HTTP endpoints with configurable warmup runs, reporting p50/p95/p99 and flagging endpoints above 200ms, 500ms, or 1s. Entry point perf_scan.py.
• -Cortex: llm_usage_scanner.py detects missing error handling on LLM calls, unbounded cost patterns, hardcoded model names, and synchronous calls inside async functions. prompt_evaluator.py scores prompt files for injection risk, output format contracts, and token efficiency. Entry point eval_scan.py.
• -Forge: infracost_analyzer.py wraps the Infracost CLI for per-resource cost diffs. cloud_cost_fetcher.py queries AWS Cost Explorer over a 14-day window, flagging services with over $50 monthly spend or over 20% week-over-week growth. Entry point cost_scan.py.

Also added

• -/contribute skill for Pave: forks the repo, scaffolds a branch, runs compliance checks, guides contributors through the PR process.
• -/form-brief: extracts a structured design brief before any visual work begins.
• -/form-critique and /draft-wireframe absorb design principles from the open-design project.

Fixed

• -CI test matrix was wired to non-existent venv paths; now activates each agent's virtual environment correctly before running pytest.
• -[email protected] in .trunk/trunk.yaml referenced a pre-release version; downgraded to 3.13.3.

Changed

• -New check-versions CI job runs scripts/bump-version.py --check on every PR, so version drift across 194 manifest files can no longer merge undetected.