Harness upgrade — new harness, same product

A project keeps its own copy of the harness: the version of the Keelokit template it was generated from (_commit in .keelokit/answers.yml). Updating the plugin doesn't change that copy; this skill does. Say it that way to the user: it brings Keelokit's new rules and checks into the project, on a branch, and never rewrites their product.

The template owns infrastructure (CI, lint/format/ts base configs, scripts/verify.sh, git hooks, .keelokit/ except the project's own choices: rules.local.toml, exceptions.toml, critical.toml, profile.toml, verify-routing.toml, red-causes.toml and verify-clock.toml). The product owns its code (apps' src/, e2e, prisma schema and migrations, locale files, packages' src/) and its knowledge (docs/context/, docs/prd.md, docs/escapes.md, backlog/, README.md, CHANGELOG.md) — Copier never overwrites those once they exist.

1. Working tree clean (git status), on a branch: git switch -c chore/keelokit-upgrade.
2. See where you are: grep _commit .keelokit/answers.yml. Pick the target tag (latest by default).
3. Run:

   uvx copier==9.18.2 update -a .keelokit/answers.yml --defaults --conflict rej --vcs-ref <tag>

   -a .keelokit/answers.yml is required (Keelokit keeps its answers there). If _src_path in that file is a local path, the project can only upgrade from that machine — point it at the git source (gh:<owner>/keelokit) first. From a version before 0.10.0 the update brings new files and checks, none of which breaks the project. The doctor warns (not fails) about a missing .gitattributes eol=lf; CI-2 fails only for a CI job you added that .keelokit/verify-map.toml lacks (add it to the map, same commit; the map is the template's, so the update merges its new rows into yours); and docs/prelaunch-debt-ledger.md, docs/ci.md, .keelokit/bin/ci.py, status.py and the agent brief arrive as new files. verify now also takes a per-machine lock; the CI gains a nightly trigger, a manual trigger and a ci-report job.
4. Resolve every *.rej: keep the project's intent, take the template's structure; delete the .rej files. Read the Keelokit CHANGELOG entries between the two versions for what changed and why.
5. pnpm install, then pnpm verify --all and python3 .keelokit/bin/doctor.py. New house rules may fail on purpose: meet them, or register an exception with the user's approval. Coming from a version before run-local (the harness has no .keelokit/bin/run-local.sh yet) with a mobile trait: the script arrives with the upgrade, but profile.toml is the project's, so no [local] block comes with it and the doctor warns (RUN-1). Offer /keelokit:run-local, which detects it and writes the block after a yes.
6. Commit chore: upgrade Keelokit <from> → <to> and report: rules added/changed, conflicts resolved, and anything the user must decide.