v2.3.1: fix startup crash when click is not installed

typer 0.26+ dropped click as a dependency, so skill_ref_gen's top-level
import click caused wbox to crash on startup in clean environments.
Deferred the import to inside the regen-skill-refs command body so click
is only required when that hidden dev command is actually invoked.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix(release): defer skill_ref_gen import to avoid click dependency at…

… startup

typer 0.26+ no longer depends on click, so it's not installed in the
binary build environment. skill_ref_gen.py imports click at module level,
causing wbox to crash on startup. Moving the import inside regen_skill_refs()
defers it until the hidden dev command is actually invoked — normal CLI
commands no longer need click at all.

Also reverts the spurious --hidden-import click flag added in the prior
attempt (it was a no-op since click was never installed).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

v2.2.1: gate `wbox self upgrade` on install kind

`wbox self upgrade` was silently no-op'ing for uv/pipx installs: it
computed the install root from `sys.executable` (the venv's python.exe)
and tried to swap the console-script shim there, but PATH points at a
copy uv/pipx made under ~/.local/bin. Replacing the venv-side shim
never changed what `wbox` resolved to, and the deferred Windows helper
left a `wbox.exe.partial.<ts>` orphan with no status file.

`upgrade_cmd` now detects the install kind (`bundle` / `uv-tool` /
`pipx` / `pip`) via `sys.frozen` + a path heuristic on `sys.executable`,
and refuses with the correct follow-up command when it's not the
standalone bundle. No download, no partial file, no orphaned marker.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

release: v2.2.0 — `wbox me user-id`, users list pagination, Node 24 CI

Highlights:

- feat(me): `wbox me user-id` and table relabeling to disambiguate the
  login profile ID from the workspace user ID (closes #90).
- fix(users): paginate `wbox users list` so firms with >25 users see
  the full list.
- ci: fix mkdocs docs deploy, bump deprecated Node 20 actions to Node
  24-compatible versions ahead of GitHub''s June 2 2026 cutoff.

fix(users): paginate `wbox users list` so firms with >25 users see th…

…e full list

The CLI was calling the single-page `list_users()` and exposes no
--page/--per-page flags, so any firm with more users than the API
default page size silently got a truncated list. Switch to the
existing paginated `list_all_users()` (already used by the firm
bootstrap path) so the CLI matches the bootstrap path's correctness.

Add a respx test that mocks two pages and asserts all 120 users
make it through `wbox users list --format json`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

chore: remove dead v1 codex plugin manifest, consolidate changelog (#89)

Follow-up to #27 / #50 — v2.0.0 cleanup audit found two leftovers.

- Delete `.codex-plugin/plugin.json`. PR #51 (closing #27) explicitly
  punted on this manifest because "the issue scope is explicit and
  `.codex-plugin/` is not in the deletion list" — but its sibling
  artifacts (the Claude marketplace manifest and the `codex-skill/`
  mirror) were deleted, leaving this file with a broken `./codex-skill`
  pointer to a directory that no longer exists. Removing it makes the
  v2.0.0 changelog claim "Removed v1 distribution artifacts (#27)"
  fully accurate.

- Consolidate the changelog. Migrate the v0.1–v1.3 history from
  `docs/changelog.md` into the root `CHANGELOG.md` (which previously
  held only the v2.0.0 entry), delete the docs copy, and drop the
  Changelog entry from `mkdocs.yml` nav. Single source of truth at the
  repo root, no duplication risk for future releases.

`ruff check src/ tests/` clean. `pytest -q` 391 passed, 1 skipped.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

refactor: address /simplify findings; revise version to 1.5.1

Cleanups on top of the prior commit, then revising the version bump from
1.6.0 to 1.5.1 to keep the release patch-scoped.

Code:
- ASCII-only stderr (drop unicode glyphs in workflows complete-step hint),
  matching the project's Windows console convention.
- complete-step now runs the mutation + advance-hint GET in a single
  event loop / shared httpx client, saving a TLS handshake and a
  rate-limiter file roundtrip per call.
- Extract `_workflow_state(workflow)` so `workflows next` and
  `_emit_advance_hint` share the "completed_at-vs-active_step" branch.
- Order swap in `output_result`: `_filter_fields` runs before
  `_strip_html_keys` so we don't recurse into fields we're about to drop.
- Put `comments` directly in `_GET_DEFAULT_FIELDS` and drop the dense
  conditional concatenation.
- Trim narrative comments down to one-liners; better `--no-advance-hint`
  help text noting the saved API call.

Tests:
- `test_complete_step_no_advance_hint_skips_followup` now asserts
  `result.stderr == ""` (user-visible behavior) instead of a
  call_count implementation detail.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

chore: bump version to 1.5.0

Bundles three task/contact UX improvements:
- feat(tasks): kebab-case --frame accepted; document Sunday "next_week" quirk (#18, #19)
- feat(contacts): top-level --tags flag on update + add subcommands (#20)
- fix(comments): align --no-comments code and docs; contacts get does not have a comment flag (#21)

Also re-syncs plugins/ and codex-skill/ skill mirrors via scripts/sync-plugin.py.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>