skill-v4.8.0

- **Devin and Replit Agent.** `npx impeccable install` sets the skill up for Devin on the web, in the CLI and on Desktop, and accepts `windsurf` as another name for it. A project with a `.replit` file is read as Replit Agent, so the installer names it, not Codex CLI, when it writes to `.agents`. Thanks to @faocampo and @Kodylow for asking.

- **Findings on the pull request.** In a GitHub Actions job, `impeccable detect --github` turns each finding into an annotation on the line that caused it. `--list-rules` prints every rule with its category and description, and `--scope` or `--no-advisory` narrows the list. Thanks to @mvanhorn for both.

- **A second look at hard offset shadows.** A crisp shadow pushed 4px or more is flagged as an advisory, not a failure, because it can be a deliberate neobrutalist choice. Keep one with `data-impeccable-ignore="hard-offset-shadow"`. Thanks to @mager for the contribution.

- **Cursor checks the edit it just made.** The design hook runs after each write instead of gating it, with one scan per edit. `update` and `doctor --fix` move an existing hook over.

- **Hooks find your projects.** A session started in a folder above your projects now gets the end-of-session review for each project it edited. Codex hooks in your user folder are detected, and `doctor` checks their launcher. Thanks to @Shandy1972v.

- **Checked engine downloads.** The launcher, the npm package and `install` compare each engine download with a list of digests committed alongside the skill, not one published next to the file, and refuse a binary that does not match. Thanks to @jojig-dao for the design.

- **Installs that hold up.** A slow download waits as long as data keeps arriving, instead of failing at 120 seconds. If an update cannot reach the bundle, your installed skills stay as they are. Every Windows `.cmd` ships with CRLF line endings, Copilot global hooks work on Windows, and the commands Impeccable prints run in PowerShell.

- **Live mode.** Tune values survive closing the panel and reloading the page (thanks to @mager). Patching a page's Content-Security-Policy meta tag no longer corrupts the file, and phones no longer raise the keyboard when live mode loads.

- **Fewer false alarms.** `straggler` measures the last word instead of estimating it, and sees a `text-wrap: pretty` that Firefox dropped (thanks to @stedmanhalliday for both). `design-system-radius` no longer reads the numbers inside `calc()`, `min()` or `max()` as radii (thanks to @iamceph). Text dimmed by a stepper's resting state is an advisory, while text a script parked mid-reveal still counts. In a monorepo, each file's design tokens come from its own package first. A negative value in a margin shorthand is no longer lost. Legal and footnote blocks are exempt from line length and tiny text. URL scans skip cookie notices, splash gates and hidden mockups, and contrast reads gradient text and dark surfaces correctly. Images set through `srcset` count, and `cramped-padding` sees through a transparent wrapper (thanks to @BibaPutt).

- **Side stripes on table rows.** A colored stripe down one side of a status row or cell now reports as a side tab, in URL scans as well as file scans, and an `!important` reset stands it down.

- **Arabic-script text.** `harden` now covers ZWNJ, Yeh and Kaf variants, local digits and calendars for Arabic-script languages. Thanks to @FawwazLawal.

- **Fixes.** Ask for more directions than the weighing supports and new work shows the ones that earned a place and says so, instead of padding the hand (thanks to @tehzunm-ctrl). `**/` in an ignore pattern stops at folder boundaries, so one waiver no longer skips an unrelated page. Live mode starts in a page that blocks storage. Audit's contrast and touch-target checks match WCAG AA. Thanks to @srobroek.