• fix: `cmdchamp test` now exits non-zero on failure (was always 0 — masked broken tests)
• fix: profile/score integrity — survive unset/relative HOME and unwritable data dir; reset can't destroy its own backup
• fix: vi operator keys can no longer freeze the boss/challenge timer
• fix: bracketed paste — multi-line pastes flatten to one line, no early submit
• fix: cap sandbox processes against fork bombs
• fix: Home/End/Del no longer leak bytes as vi commands
• fix: ss "all connections" no longer listening-only; awk skips csv header; drop searchsploit -m footgun
• feat: confirm before reset wipes progress (scriptable when piped)
• ci: shellcheck + full test suites on push