fix(init): keep the Claude Code trust entry current, and stop chaining Taskless commands

[theCodeDrift]

An onboarding agent in Claude Code's auto mode was refused even though the user had a Taskless CLI: entry in autoMode.allow:

Bash(S=<scratchpad> && mkdir -p $S && npx @taskless/cli@0… )
  ⎿  Denied by auto mode classifier ∙ [Untrusted Code Integration]

It had wrapped the pinned call in shell plumbing to stash its output, so the line no longer started with the call the entry describes. The skill's fallback then told the user to add the entry they already had. Their entry was also hand-copied older text, and since a present entry was never rewritten, no install or update could fix it.

What changes

• Skill body: run every Taskless command on a line of its own beginning with the pinned invocation: no VAR=, cd, mkdir, &&, ;, pipe, or redirect. Files a recipe needs go through the agent's file tools. A refused line that combined the call with anything else is rerun once on its own. When the current entry is already in ~/.claude/settings.json, the agent says so instead of asking for it again.
• Entry text: one added sentence. The pinned call stays covered when the same line sets a variable, changes or creates a directory, or redirects the call's output to a file; every other command on the line is judged on its own. Pipes are deliberately not covered.
• Stale entries are replaced on install/update. The Taskless CLI: label is ours: an entry carrying it with any other text is stale. The wizard (bare npx @taskless/cli, which is how a person both installs and updates) shows REPLACE (global): and swaps it in place, keeping list order, under the one existing confirmation. Declining leaves the file byte-identical. Only the first labelled string is replaced, and an unlabelled string is never treated as ours.
• init still never writes outside the project. It warns that the entry is out of date, and init --json reports globalTrust[].state: "stale". The init recipe documents the new state.

The skill body is at exactly 150 lines, its cap.

Checks

• pnpm typecheck, pnpm lint: pass
• pnpm --filter @taskless/cli test: 128 files, 2372 tests pass
• OpenSpec change refresh-global-trust-entry archived on this PR. The scenario check from CLAUDE.md shows no scenario dropped from agent-global-trust or skill-taskless.