settings: three tiers - wikitool.json (instance), .wikitool-local.json (checkout), secrets by reference incl. 1Password CLI; new command config set (#207)

Every settings field declares its tier; a value in the wrong file is an error naming
file, key and tier. A field naming a program or affecting a gate cannot be declared
instance. Secrets are references only: {"ref": "<name>"} via WIKITOOL_SECRET_<NAME> or
a user-only secrets file, {"ref": "op://..."} via op read (locked 1Password: exit 42).
The preflight records op as an optional tool. doctor gains one line per tier, docs
verify checks a committed wikitool.json for plaintext secrets, CI resolves a real
op:// value through 1password/load-secrets-action. No feature reads its settings
this way yet; without the two files every other command is unchanged.

Files changed:
- .gitea/workflows/ci.yml
- .gitignore
- AGENTS.md
- CHANGES.md
- INSTALL.md
- VERSION
- docs/explanation/README.md
- docs/explanation/configuration-tiers.md
- docs/how-to/README.md
- docs/how-to/use-1password-for-settings.md
- docs/reference/commands/README.md
- docs/reference/commands/configuration.md
- docs/reference/commands/instance-health.md
- docs/reference/commands/types-instructions-and-docs.md
- docs/reference/configuration.md
- docs/reference/exit-codes.md
- instructions/dev/doc-pull-through.md
- instructions/dev/testing-conventions.md
- instructions/preflight.md
- tools/CONTRACT.md
- tools/README.md
- tools/chemenu/cli.py
- tools/chemenu/cli_contract.py
- tools/chemenu/commands/_util.py
- tools/chemenu/commands/config_cmd.py
- tools/chemenu/commands/docs_verify.py
- tools/chemenu/commands/doctor.py
- tools/chemenu/config.py
- tools/chemenu/config_shapes.py
- tools/chemenu/prerequisites.py
- tools/chemenu/settings.py
- tools/chemenu/tests/conftest.py
- tools/chemenu/tests/test_dist_cmd.py
- tools/chemenu/tests/test_preflight.py
- tools/chemenu/tests/test_preflight_pwsh.py
- tools/chemenu/tests/test_settings.py
- tools/chemenu/toolpaths.py
- tools/preflight.ps1
- tools/preflight.sh
- tools/prerequisites.txt

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SnAJ7Z3CpVD3PRbN73QtU2

AGENTS.md

@@ -16,6 +16,7 @@ maintained permanently; anything mechanical is done by `tools/wikitool`, never b
 - [File naming](#file-naming)
 - [Personalization](#personalization)
 - [Environment](#environment)
+- [Settings](#settings)
 - [Routing](#routing)
 - [Gates](#gates)
 - [Tool error contract](#tool-error-contract)
@@ -153,7 +154,7 @@ type, index, lint or provenance; `dist export` ships it verbatim except `docs/de
 verify` checks only that every file sits in one of its five subdirectories, and no other
 `tools/wikitool` command touches it.
 
-Six explanation pages are reached from this file, each by link rather than automatically:
+Seven explanation pages are reached from this file, each by link rather than automatically:
 [docs/explanation/pipeline-rationale.md](docs/explanation/pipeline-rationale.md) (why the
 pipeline has four stages),
 [docs/explanation/ownership-and-templates.md](docs/explanation/ownership-and-templates.md) (why
@@ -165,10 +166,13 @@ reader rather than the owner),
 [docs/explanation/why-gates-are-code.md](docs/explanation/why-gates-are-code.md) (why the
 gates in [Gates](#gates) are code rather than instruction),
 [docs/explanation/version-model.md](docs/explanation/version-model.md) (why a version number
-answers a compatibility question and a migration question separately), and
+answers a compatibility question and a migration question separately),
 [docs/explanation/knowledge-and-commitment.md](docs/explanation/knowledge-and-commitment.md) (why
 commitments live in a task tracker rather than in `kb/`, and why the two are joined at read time
-instead of synced). A seventh, `docs/explanation/model-and-effort-selection.md`, is deliberately
+instead of synced), and
+[docs/explanation/configuration-tiers.md](docs/explanation/configuration-tiers.md) (why settings
+sit in three tiers, why a value has exactly one place, and what keeping secrets out of the tree
+does not protect against). An eighth, `docs/explanation/model-and-effort-selection.md`, is deliberately
 not linked here but from `CLAUDE.md`: it decides something only that harness has to decide, and
 a link here would load it into the other three.
 
@@ -210,6 +214,30 @@ It carries no authority: a remote or MCP server listed here does not authorize a
 (invariant 5) or open a gate, and does not source a `kb/` claim (invariant 3). It holds no
 credentials - it sits in plaintext in the working tree and in every agent's context.
 
+## Settings
+
+`wikitool` reads its settings from two files at the root: `wikitool.json`, committed, for what
+is the same in every clone of the instance, and `.wikitool-local.json`, gitignored, for what is
+true only for this checkout. Secrets sit in neither - both hold only a reference to them,
+`{"ref": "<name>"}` or `{"ref": "op://<vault>/<item>/<field>"}`. Each field declares which tier
+it belongs to, and **a field that names a program to run or affects a gate is never in the
+committed file**, not even as a reference: a pull from another clone must not change what
+`wikitool` executes or where it pushes. The code refuses to declare such a field otherwise.
+
+- Write a setting with `tools/wikitool config set`, which puts it where its tier says. A field
+  that names a program or affects a gate is the user's to edit by hand - `config set` exits 42
+  and says so.
+- **A secret never passes through you.** Never ask for one in the chat, never put one on a
+  command line, and never read the secrets file or run `op read` to look at one. Ask the user to
+  put the value into 1Password, the secrets file or a `WIKITOOL_SECRET_<NAME>` variable, then set
+  the reference.
+- `tools/wikitool doctor` reports whether both files pass and whether each reference resolves -
+  never a value.
+
+Like `ENVIRONMENT.md`, neither file sources a `kb/` claim (invariant 3). What keeping secrets
+out of the tree does and does not protect against:
+[docs/explanation/configuration-tiers.md](docs/explanation/configuration-tiers.md).
+
 ## Routing
 
 **The pipeline** - four stages, each with one job: