merge: origin/main into next for the 0.0.50 integration line

next carries 108 commits main lacks; main carries 23 next lacks, including
the MOSAIC_GIT_IDENTITY work that per-agent git credentials depend on.
Neither stream alone can ship 0.0.50: next drops identity, main drops
everything since the split.

Conflicts and how they were settled:
- packages/mosaic/package.json test:framework-shell -- union. Neither side
  removed an entry; next added 6, main added 8, one shared. 50 total.
- framework/tools/git/pr-merge.sh -- next's form. It permits base 'main' or
  'next'; main's permits 'main' only, and the release line targets next.
- framework/tools/git/test-ci-queue-wait-tristate.sh -- both sides appended
  to the same region (next: merge-readiness assertions; main: a real-clock
  watchdog control). Kept both.
- docs/SITEMAP.md -- both sides appended distinct sections. Kept both.

README.md

@@ -74,6 +74,14 @@ The launcher verifies your config, checks for `SOUL.md`, injects your `AGENTS.md
 
 Pi launches default to a token-lean skill posture: `mosaic pi` passes `--no-skills` so Pi does not preload every global skill description into the system prompt. Use `MOSAIC_PI_SKILL_MODE=all mosaic pi` for the legacy all-skills catalog, or `MOSAIC_PI_SKILL_MODE=discover mosaic pi` to let Pi use its native settings/project skill discovery.
 
+Mosaic also loads its Pi extensions from `~/.config/mosaic/runtime/pi/`. Inside Pi,
+`/goal set <statement>` starts a bounded persistent loop that checks every turn and successful
+compaction, requires two evidence-bearing completion reports, and can be inspected or stopped with
+`/goal status`, `/goal pause`, `/goal resume`, and `/goal cancel`. Controller-owned goal-state
+entries redact common credential shapes, but Pi's model/tool-call history is separate, so goals and
+evidence must never contain secrets or raw sensitive output. Mosaic does not install this extension
+into `~/.pi/agent/extensions/`.
+
 ### TUI & Gateway
 
 ```bash