docs: resync skills with smg HEAD (v1.9.0)

[hello-alexmcc]

Skills were last verified against smg 72ec2bfa (v1.6.0, 2026-07-15). origin/main is now 732a42bf — 235 commits and three releases later. This resyncs them.

Every skill was audited against the current code (not commit messages) against a clean origin/main snapshot, each finding was put to an independent reviewer instructed to refute it, and the edited files were then re-read against the code by a third pass. Result: 24 blockers, 118 major, 105 minor applied. 6 findings were refuted and dropped; 11 more were skipped at apply time because their premise did not hold on inspection.

Full audit report (evidence and per-finding proposed fixes): https://claude.ai/code/artifact/bc643be0-85de-4c83-bafd-b58c073c4159

New coverage

Two subsystems landed after the baseline with zero skill coverage:

• skills/implement/zmq-backend.md (new recipe) — the ZMQ direct backend: crate engine-zmq-client, ConnectionMode::Zmq, BackendClient::{Grpc,Zmq}, the background-handshake worker lifecycle, grouped DP engine workers, the append-only positional-msgpack wire contract, and GPU-free testing via mock-worker. It gets its own recipe rather than a section in grpc-backend.md because every step there is inapplicable (no tonic client, no probe, no metadata RPC, and the polymorphism point is BackendClient, not GrpcClient). Previously the detection table actively mis-routed ZMQ requests to grpc-backend.md; there is now a detection row and a "not this recipe" pointer.
• Per-tenant rate limiting (model_gateway/src/rate_limit/) — added to rate-limit-feature.md, which previously asserted no such thing existed.

Blockers

Text naming a deleted symbol, or snippets that no longer compile:

Skill	Was	Is
rate-limit-feature	ConcurrencyLimiter / QueueProcessor / QueuedRequest; refill falls back to max_concurrent_requests; timeout 408	AdmissionQueue (Semaphore) + TokenPermit, FIFO handoff on the bucket; unset/0 means no refill; timeout sheds 503
provider-api, tenancy-feature	body: &CreateMessageRequest	RouterTrait typed-JSON methods take the body by value
map, discovery-feature	handle_pod_event()	level-triggered reconcile: compute_desired_state → compute_actions → Job::AddWorker/RemoveWorker
routing-policy	add your policy to is_load_aware()	override LoadBalancingPolicy::needs_backend_loads() — skipping it compiles and silently never receives update_loads
config-plumbing	my_field: self.my_field in the ServerConfig literal	ServerConfig is its own struct; a RouterConfig field rides in .router_config. Adds the missing RouterConfigBuilder and config/validation.rs steps
observability-feature	intern_string(&model_id)	the unbounded interner is the series-explosion vector closed upstream; now teaches the bounded path
scheduler-feature	QueueTimeout → 408	503 + Retry-After
wasm-plugin	scaffold without [workspace]; unconditional wasm-tools component new	scaffold that builds; guest failures fail open (previously unstated, and load-bearing for a security guest)

Cross-cutting

• Worker eligibility is now Worker::is_available() (health + circuit breaker + overload veto). routing-policy, review-pr and anti-patterns all taught the pre-veto two-term check — which silently routes to overload-vetoed workers.
• contribute gate rebuilt from CI: pre-commit hooks, ruff/mypy/pytest at an 80% coverage floor, the Go gate, cargo metadata --locked against the now-tracked Cargo.lock, branch-name rules that auto-close non-conforming PRs, and the OpenCV prerequisite for --all-features. Five steps → six, with README, implement/SKILL.md and .agents/workflows/verify-pr.md updated to match.
• review-pr severity markers now match this repo's own REVIEW.md contract (🔴/🟡/🟣); e2e marker set corrected (registered in fixtures/hooks.py, plus kind in pyproject.toml).
• Counts/versions: tool parsers 14 → 17 modules / 22 factory keys; reasoning families 8 → 9; Python Router params ~110 → 140; data-connector 2.3.2 → 2.3.3; rmcp locks to 1.8.
• Org move lightseekorg → smg-project across every README install command and all three plugin manifests. Upstream docs now live in smg-docs.
• Recipe count 19 → 20.

Checks

• No trailing whitespace; every file ends with one newline; all three manifests parse as JSON.
• No path.rs:123 line-number citations (the de-brittled convention from docs: resync skills with smg HEAD (v1.5.0) #19 holds); every @recipe.md cross-reference resolves.
• Recipe count consistent at 20 across README prose, README table and all three manifests.
• codespell --skip=LICENSE reports 15 hits on both main and this branch — all pre-existing false positives on WIT (the WebAssembly Interface Types format name). None introduced.

Reviewer notes

• The audit's independent-refutation pass covered 19 of 27 units before hitting a usage limit. For the remaining eight, the highest-severity claims (every rate-limit blocker, the CI-gate claims, the kv-index/multimodal/e2e majors) were verified by hand; the rest rest on a single audit plus the applying agent's own verification. Worth a closer look at the minor findings in kv-index-feature.md and multimodal-feature.md.
• Two upstream bugs surfaced while verifying, not fixed here: bindings/python/src/smg/serve.py's _zmq_handshake_port docstring points at model_gateway/src/worker/worker.rs, but derive_handshake_port lives in routers/grpc/zmq_client.rs; and the doc comments on protocol/mod.rs::EngineLoad and ZmqEngineClient::engine_load still say TokenSpeed carries no load, which BatchTokenIDOutSlim now contradicts.

Verified against smg@732a42bf.