Ported the staged restore payload from the recodee restore worktree into this repository's active gx agent branch so guardex scripts, hooks, AGENTS, and OpenSpec docs are restored in one coherent changeset.

Constraint: Restore source existed in sibling recodee worktree and could not be auto-finished there due elevated write limits
Rejected: Recreate changes manually in-place | high risk of omission and drift
Confidence: high
Scope-risk: moderate
Reversibility: clean
Directive: Keep base and main checkout unchanged; continue restoration work only through agent worktrees
Tested: bash -n on modified hook and script files
Not-tested: full npm test and lint pipeline

Restored the package manifest to the guardex publish baseline and advanced version to 5.0.17, with matching README release notes, so the branch can publish a new npm artifact immediately.

Constraint: NPM publish requires a non-private guardex manifest and a unique semver
Rejected: Add only a version key on the restored private codex-lb-dev manifest | still not publishable
Confidence: high
Scope-risk: narrow
Reversibility: clean
Directive: Keep package.json version and README release notes in sync on every publish bump
Tested: node -p package name/version; npm pack --dry-run
Not-tested: npm publish to registry

Add the required branch-scoped OpenSpec checklist so agent-branch-finish can merge this release branch to main without bypassing policy guards.

Constraint: agent-branch-finish enforces openspec/changes/<branch-slug>/tasks.md with sections 1-4
Rejected: bypass finish script and merge manually | violates repository merge protocol
Confidence: high
Scope-risk: narrow
Reversibility: clean
Directive: Keep branch-slug OpenSpec checklist updated before invoking finish
Tested: agent-branch-finish gate precondition file structure and checklist format
Not-tested: post-merge runtime behavior