fix: telemetry/memory flag mismatches, doc drift; add CI; self-dogfood

Parallel fleet audit (2 background agents) + direct work:

- src/commands/memory.mjs: `memory put --allow-secrets` was read as
  `flags.allowSecrets` (camelCase) but the CLI parser only emits
  kebab-case keys, so the flag was always undefined/false. Fixed to
  `flags['allow-secrets']`.
- Docs: `lh graph --brief` was referenced 14x across 5 agent.md files,
  harness.instructions.md, 4 SKILL.md files, onboard.prompt.md, and
  README, but `lh graph` has no --brief flag (terse output is already
  the default, --json/--severity are the only flags). Corrected every
  reference to match actual CLI surface.
- .github/workflows/ci.yml: run npm install/validate/test on node 20+22.
- Self-dogfooded `lh init --yes` in this repo, producing .agents/
  (harness.config.json, architecture.md, conventions.md, memory
  shards). `lh doctor` now reports all required checks green.
- Deduped .gitignore harness block against init's auto-managed block.

Verified: 53/53 tests pass, validate 0 errors, doctor all-green.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.github/agents/architect.agent.md

@@ -16,7 +16,7 @@ Write the spec. Make every acceptance criterion checkable.
 1. Read `.agents/specs/<slug>/decisions.md` first.
 2. Stop if decisions are missing or incomplete.
 3. Run `lh index --budget 6000 --focus <relevant-glob>`.
-4. Run `lh graph --brief`.
+4. Run `lh graph`.
 5. Delegate focused read-only reconnaissance to `scout` when needed.
 6. Consult Context7 before using any external library or framework API.
 7. Use `resolve-library-id` before `query-docs`.

.github/agents/conductor.agent.md

@@ -30,7 +30,7 @@ Run the full lean harness pipeline. Edit no product files.
 15. For plan, invoke `architect`.
 16. Require `.agents/specs/<slug>/spec.md`.
 17. Invoke `splitter` to write `.agents/specs/<slug>/plan.dag.json`.
-18. Validate the DAG with `lh graph --brief`.
+18. Validate the DAG with `lh graph`.
 19. Own the dynamic DAG after splitter returns.
 20. For every checkpoint, read lane status and verifier output.
 21. Re-plan at every checkpoint.
@@ -73,7 +73,7 @@ Run the full lean harness pipeline. Edit no product files.
 - Stop when `lh run end` completes and final verify passes.
 - Stop when design answers remain missing.
 - Stop when max Ralph iterations are reached.
-- Stop when `lh graph --brief` keeps failing after re-plan.
+- Stop when `lh graph` keeps failing after re-plan.
 - Stop when host strategy forbids required action.
 
 ## NEVER DO THIS

.github/agents/reviewer.agent.md

@@ -16,7 +16,7 @@ Approve or reject. Check every criterion.
 2. Read `.agents/specs/<slug>/spec.md`.
 3. Read `.agents/specs/<slug>/plan.dag.json`.
 4. Read verifier output.
-5. Run `lh graph --brief` unless fresh passing output exists.
+5. Run `lh graph` unless fresh passing output exists.
 6. List assigned acceptance criteria by id.
 7. Check each criterion individually.
 8. Check changed files against declared scope globs.
@@ -34,7 +34,7 @@ Approve or reject. Check every criterion.
 
 1. All declared verify commands pass.
 2. Every assigned `AC-###` passes.
-3. `lh graph --brief` passes.
+3. `lh graph` passes.
 4. Changed files stay inside declared scope.
 5. Decisions from `.agents/specs/<slug>/decisions.md` are honored.
 

.github/agents/scout.agent.md

@@ -14,7 +14,7 @@ Recon the repo. Return facts, not dumps.
 
 1. Treat the assignment as read-only.
 2. Run `lh index --budget <N> --focus <glob>` before manual reads.
-3. Run `lh graph --brief` before manual reads.
+3. Run `lh graph` before manual reads.
 4. Read `.agents/memory/INDEX.md` only if the assignment needs history.
 5. Pull memory shards only by explicit relevance.
 6. Search by symbol, path, or glob before opening files.

.github/agents/splitter.agent.md

@@ -15,7 +15,7 @@ Emit the lane DAG. Keep write scopes disjoint.
 1. Read `.agents/specs/<slug>/spec.md`.
 2. Read `.agents/architecture.md` when present.
 3. Run `lh index --budget 6000 --focus <relevant-glob>`.
-4. Run `lh graph --brief`.
+4. Run `lh graph`.
 5. Extract every acceptance criterion id.
 6. Group work by independently verifiable outcomes.
 7. Create read lanes for discovery-only work.
@@ -29,7 +29,7 @@ Emit the lane DAG. Keep write scopes disjoint.
 15. Add verify commands when known.
 16. Add checkpoint hints for risky lanes.
 17. Write `.agents/specs/<slug>/plan.dag.json`.
-18. Run `lh graph --brief` after writing.
+18. Run `lh graph` after writing.
 19. If graph fails, revise the DAG until it passes or report blocker.
 20. Return lane count, dependency shape, and risk lanes.
 
@@ -65,7 +65,7 @@ Emit the lane DAG. Keep write scopes disjoint.
 - Stop when spec is missing.
 - Stop when acceptance criteria are unnumbered.
 - Stop when write scopes overlap and cannot be separated.
-- Stop when `lh graph --brief` blocks the DAG.
+- Stop when `lh graph` blocks the DAG.
 
 ## NEVER DO THIS