docs: include img2threejs in stocktake audit table and sync readme diagram

CHANGELOG.md

@@ -16,6 +16,7 @@ Catalog update for AI LABS 8-repo wave adaptation and hygiene patch. Totals beco
 - `docs/warehouse-inventory.md`: `DEFER` no longer promotes to `NEW` without an existence pass and a no-skill baseline. Capability drift is grounds for `COMPRESS`/`RETIRE`, never a twin skill. Wave 1–3 counts are unchanged.
 - Document NVIDIA SkillEvaluator as `FOREIGN_ON_DEMAND`: never installed, absent is not a doctor failure, and a malformed MCP entry still fails closed.
 - Execute the stocktake protocol across all 62 catalog items and record it in `docs/stocktake-1.8.3.md`: one verdict per item, 56 `KEEP`, 2 `COMPRESS`, 4 `UPDATE`, 0 `MERGE`, 0 `RETIRE`. `MERGE` is zero on measured evidence, the highest description overlap being 0.359 Jaccard, below the 50% warn line. No item is retired without a no-skill baseline; five candidates are recorded as blocked on the A/B gate.
+- Stocktake documentation (`docs/stocktake-1.8.3.md`) now includes `img2threejs` (63 rows, KEEP).
 - `README.md`: document optional `stitch` MCP alongside `serena` and `exa`. Enabled only by `opencode-bf stitch enable`, keys referenced as `{env:STITCH_API_KEY}` or omitted with `--oauth`, not an owned core server and not a production UI implementer, absent is not a doctor failure.
 - Retire the predecessor `GrokBuild` host-product name from four skill bodies (`ask-matt` description, `chrome-devtools-axi` heading, `adhd`, `visual-studio`). `ask-matt` matters most: its description loads on every session. Tool-family references that name an image/video contract rather than the host are left intact.
 - `chrome-devtools-axi`: drop a `$HOME/.grok/bin` fallback that contradicted `rules/00-routing.md` ("Do not depend on `~/.grok` at runtime") and reconcile two duplicated invocation blocks. Port `9223`, the `HEADED`/`AUTO_CONNECT` prohibition, and the never-fall-back-to-Google-Chrome fence are unchanged.

README.md

@@ -61,7 +61,7 @@ Restart OpenCode after install. Config is not hot-reloaded.
         ┌───────────────────┼────────────────────┐
         ▼                   ▼                    ▼
       Skills               MCP                 Rules
-     46 automatic       Codebase Memory        Verification
+      47 automatic       Codebase Memory        Verification
      16 manual          Context7              Engineering
                        shadcn
         │

docs/stocktake-1.8.3.md

@@ -1,8 +1,8 @@
 # Catalog Stocktake — 1.8.3
 
-Executed per [skills/skill-stocktake/SKILL.md](../skills/skill-stocktake/SKILL.md) against `main` at `4b1fd7f2` (tree `bc3d12c6`).
+Executed per [skills/skill-stocktake/SKILL.md](../skills/skill-stocktake/SKILL.md). Earlier rows were taken against `main` at `4b1fd7f2` (tree `bc3d12c6`) under the #18 protocol; `img2threejs` was added post-PR #21 at `66eebe9`.
 
-Measured tree: **46 model-invoked** (`skills/*/SKILL.md`) + **16 manual** (`manual-skills/*/SKILL.md`, each with a matching `commands/<name>.md`) = **62**. Matches `vendor/skill-policy.json` and `vendor/skill-allowlist.txt`.
+Measured tree: **47 model-invoked** (`skills/*/SKILL.md`) + **16 manual** (`manual-skills/*/SKILL.md`, each with a matching `commands/<name>.md`) = **63**. Matches `vendor/skill-policy.json` and `vendor/skill-allowlist.txt`.
 
 License column is authoritative from `vendor/license-audit.json`, not frontmatter. A missing frontmatter `license` key is not a gap: 28 of 62 deliberately defer to the audit file.
 
@@ -38,6 +38,7 @@ License column is authoritative from `vendor/license-audit.json`, not frontmatte
 | grilling | model | KEEP | 23 lines; non-default primitive, explicitly named-only | — |
 | humanizer | model | KEEP | 64 lines, NOTICE present; paired with manual `/unslop` | — |
 | hyperframes | model | KEEP | 48 lines, Apache-2.0 with NOTICE; HTML→MP4 lane | — |
+| img2threejs | model | KEEP | 50-line first-party MIT factory; image→procedural Three.js Group; fenced off scroll-world / scroll-craft / hyperframes / visual-studio / impeccable; shipped #21 | — |
 | impeccable | model | KEEP | 89-line body against 38 refs + 44 scripts — progressive disclosure working as designed | — |
 | install-anti-slop | model | KEEP | 56 lines; pinned upstream commit `e8c4880` verified in body | — |
 | matt-code-review | model | KEEP | 88 lines; two-axis review, opt-in only | — |
@@ -79,12 +80,12 @@ License column is authoritative from `vendor/license-audit.json`, not frontmatte
 
 | Verdict | Count |
 |---|---|
-| KEEP | 56 |
+| KEEP | 57 |
 | COMPRESS (applied) | 2 |
 | UPDATE (applied) | 4 |
 | MERGE | 0 |
 | RETIRE | 0 |
-| **Total** | **62** |
+| **Total** | **63** |
 
 `MERGE` is zero on evidence, not on sentiment. The highest lexical description overlap in the catalog is `matt-code-review ~ interrogate` at 0.359 Jaccard, below the 0.50 warn line in `tests/test_skills.py`. Top pairs: `humanizer ~ unslop` 0.357 (intentional model/manual twin), `supabase-ops ~ vercel-ops` 0.349, `grill-with-docs ~ grilling` 0.341 (documented composition), `scroll-craft ~ scroll-world` 0.327, `to-spec ~ to-tickets` 0.326. Each is a fenced sibling, not a duplicate.
 
@@ -134,3 +135,4 @@ A baseline cannot be produced from inside a single session that already has the
 2. Decide whether the `GrokBuild image_gen` tool-family name should be renamed catalog-wide, or documented as the intended tool contract.
 3. ~~`impeccable` frontmatter declares `Apache 2.0` while `vendor/license-audit.json` records `Apache-2.0`.~~ Resolved: frontmatter now reads `Apache-2.0`, and the audit evidence string dropped the parenthetical that only existed to flag the mismatch.
 4. 28 of 62 skills omit a frontmatter `license` key by design. If that ever becomes confusing, document it in the skill authoring guide rather than adding keys.
+5. `img2threejs` added post-#21; not part of the original 1.8.3 execution pass.