chore: update vendored skills and record provenance

humanizer 2.2.0 -> 2.9.1 (blader/humanizer, MIT): adds a Voice
Calibration section and a passive-voice pattern, reworks negative
parallelisms and em dashes. Version moved to metadata.version upstream.

impeccable 3.6.0 -> 4.0.4 (pbakaus/impeccable, Apache-2.0): the repo
tags the skill and the npm CLI separately, so 3.6.0 was a real release
and npm's 3.5.0 was never the comparison. Adds native-platform reference
briefs.

Each now carries an UPSTREAM file; bin/check-vendored.sh reports drift.

skills/impeccable/scripts/critique-storage.mjs

@@ -2,11 +2,11 @@
 /**
  * Critique persistence helper.
  *
- * Each run of /impeccable critique writes a per-target snapshot to
+ * Each critique run writes a per-target snapshot to
  *   .impeccable/critique/<timestamp>__<slug>.md
  * with a small YAML frontmatter carrying the score + P0/P1 counts.
  *
- * /impeccable polish reads the latest matching snapshot at start as its
+ * The polish workflow reads the latest matching snapshot at start as its
  * fix backlog. No other skill auto-reads critique output.
  *
  * The slug is derived mechanically from the *resolved* primary artifact
@@ -29,8 +29,9 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { getCritiqueDir } from './lib/impeccable-paths.mjs';
+import { slugFromTarget } from './lib/target-slug.mjs';
 
-const SLUG_MAX = 50;
+export { slugFromTarget } from './lib/target-slug.mjs';
 
 /**
  * Mechanically derive a slug from a resolved target. Returns null if the
@@ -40,46 +41,6 @@ const SLUG_MAX = 50;
  * concrete artifact before calling this — we never slug a natural-language
  * phrase.
  */
-export function slugFromTarget(resolved, { cwd = process.cwd() } = {}) {
-  if (!resolved || typeof resolved !== 'string') return null;
-  const trimmed = resolved.trim();
-  if (!trimmed) return null;
-
-  // URL
-  if (/^https?:\/\//i.test(trimmed)) {
-    let url;
-    try { url = new URL(trimmed); } catch { return null; }
-    const hostPath = `${url.hostname}${url.pathname}`;
-    return kebab(hostPath);
-  }
-
-  // File path. Make it project-relative so two devs critiquing the same
-  // checkout get the same slug regardless of where their repo is cloned.
-  const abs = path.isAbsolute(trimmed) ? trimmed : path.resolve(cwd, trimmed);
-  let rel = path.relative(cwd, abs);
-  // If the target is outside cwd, fall back to the basename so we still
-  // produce a stable slug (vs the absolute path, which would include
-  // home dirs / usernames).
-  if (rel.startsWith('..') || path.isAbsolute(rel)) {
-    rel = path.basename(abs);
-  }
-  if (!rel || rel === '.' || rel === '') return null;
-  return kebab(rel);
-}
-
-function kebab(s) {
-  const slug = s
-    .toLowerCase()
-    .replace(/[/\\.]+/g, '-')
-    .replace(/[^a-z0-9-]+/g, '-')
-    .replace(/-+/g, '-')
-    .replace(/^-|-$/g, '');
-  if (!slug) return null;
-  // Cap from the tail — the tail (filename) is more identifying than the
-  // top-level directory.
-  return slug.length <= SLUG_MAX ? slug : slug.slice(slug.length - SLUG_MAX).replace(/^-/, '');
-}
-
 /**
  * Filename-safe UTC ISO timestamp: hyphens for separators, trailing Z.
  * Plain colons aren't allowed on Windows filesystems.
@@ -180,6 +141,15 @@ export function readTrend(slug, { limit = 5, cwd = process.cwd() } = {}) {
 
 // ---- CLI ---------------------------------------------------------------
 
+// Accept either a ready slug or a concrete target (path/URL) everywhere, so
+// callers never have to run the slug step separately. Anything containing a
+// path or URL marker is resolved through slugFromTarget.
+function coerceSlug(value) {
+  if (!value) return null;
+  if (/^[a-z0-9-]+$/.test(value) && !value.includes('/')) return value;
+  return slugFromTarget(value);
+}
+
 function main(argv) {
   const [cmd, ...args] = argv;
   switch (cmd) {
@@ -190,8 +160,9 @@ function main(argv) {
       return;
     }
     case 'write': {
-      const [slug, bodyFile] = args;
-      if (!slug || !bodyFile) { process.stderr.write('usage: write <slug> <body-file>\n'); process.exit(1); }
+      const [slugArg, bodyFile] = args;
+      const slug = coerceSlug(slugArg);
+      if (!slug || !bodyFile) { process.stderr.write('usage: write <slug-or-target> <body-file>\n'); process.exit(1); }
       const raw = fs.readFileSync(bodyFile, 'utf-8');
       // The body file may be a full report. The caller passes the meta as
       // a JSON object on stdin if it wants structured frontmatter; otherwise
@@ -206,13 +177,13 @@ function main(argv) {
       return;
     }
     case 'latest': {
-      const latest = readLatestSnapshot(args[0]);
+      const latest = readLatestSnapshot(coerceSlug(args[0]));
       if (!latest) { process.exit(2); }
       process.stdout.write(latest.body);
       return;
     }
     case 'trend': {
-      const rows = readTrend(args[0], { limit: args[1] ? Number(args[1]) : 5 });
+      const rows = readTrend(coerceSlug(args[0]), { limit: args[1] ? Number(args[1]) : 5 });
       process.stdout.write(JSON.stringify(rows, null, 2) + '\n');
       return;
     }