fix: resolve critical issues in install.sh, settings.json, and worker-protocol

- install.sh: replace unreachable $? check with `if !` pattern (set -e
  exits before the check runs on Windows mklink failure)
- settings.json: remove fragile Bash deny patterns that can't match across
  path separators; broaden .env denies to recursive **/.env with Read/Write/Edit
- worker-protocol: align QA instruction with qa-checklist — qa_check goes in
  frontmatter envelope, not as a prose line

install.sh

@@ -62,8 +62,7 @@ create_symlink() {
         local win_dst
         win_src="$(cygpath -w "$src")"
         win_dst="$(cygpath -w "$dst")"
-        cmd //c "mklink /D \"$win_dst\" \"$win_src\"" > /dev/null 2>&1
-        if [ $? -ne 0 ]; then
+        if ! cmd //c "mklink /D \"$win_dst\" \"$win_src\"" > /dev/null 2>&1; then
             echo "ERROR: mklink failed for $name."
             echo "On Windows, enable Developer Mode (Settings > Update & Security > For Developers)"
             echo "or run this script as Administrator."
@@ -104,8 +103,7 @@ create_file_symlink() {
         local win_dst
         win_src="$(cygpath -w "$src")"
         win_dst="$(cygpath -w "$dst")"
-        cmd //c "mklink \"$win_dst\" \"$win_src\"" > /dev/null 2>&1
-        if [ $? -ne 0 ]; then
+        if ! cmd //c "mklink \"$win_dst\" \"$win_src\"" > /dev/null 2>&1; then
             echo "ERROR: mklink failed for $name."
             echo "On Windows, enable Developer Mode (Settings > Update & Security > For Developers)"
             echo "or run this script as Administrator."

settings.json

@@ -19,18 +19,18 @@
       "Read(~/.ssh/**)",
       "Read(~/.aws/**)",
       "Read(~/.gnupg/**)",
-      "Read(./.env)",
-      "Read(./.env.*)",
+      "Read(**/.env)",
+      "Read(**/.env.*)",
       "Write(~/.ssh/**)",
       "Write(~/.aws/**)",
       "Write(~/.gnupg/**)",
+      "Write(**/.env)",
+      "Write(**/.env.*)",
       "Edit(~/.ssh/**)",
       "Edit(~/.aws/**)",
       "Edit(~/.gnupg/**)",
-      "Bash(*.ssh/*)",
-      "Bash(*.aws/*)",
-      "Bash(*.gnupg/*)",
-      "Bash(*.env*)"
+      "Edit(**/.env)",
+      "Edit(**/.env.*)"
     ],
     "ask": [
       "Bash(rm *)",

skills/worker-protocol/SKILL.md

@@ -41,7 +41,7 @@ Produce the assigned deliverable. Accurately. Completely. Nothing more.
 
 ## Self-QA
 
-Before returning your output, run the `qa-checklist` skill against your work. Fix any issues you find — don't just note them. Your Self-Assessment must include the `QA self-check: pass/fail` line. If you can't pass your own QA, flag what remains and why.
+Before returning your output, run the `qa-checklist` skill against your work. Fix any issues you find — don't just note them. Set `qa_check: pass` or `qa_check: fail` in your frontmatter envelope. If you can't pass your own QA, flag what remains and why in your Self-Assessment.
 
 ## Cost sensitivity