chore(skillopt-sleep): report review findings on vendored engine to upstream microsoft/SkillOpt

[amondnet]

Context

PR #247 synced the vendored skillopt_sleep engine to upstream v0.2.0. Gemini Code Assist raised 9 findings on the vendored files, which we declined to patch locally (vendored code is read-only here — fixes belong upstream, see plugins/skillopt-sleep/README.md).

Findings to report upstream (microsoft/SkillOpt)

• [HIGH/security] scheduler.py _runner_cmd: shell command assembled without shlex.quote escaping — command injection risk / breakage on paths with spaces (feat(skillopt-sleep): sync vendored engine to upstream v0.2.0 #247 (comment))
• [HIGH] backend.py CliBackend: self._tokens / self._cache mutated from ThreadPoolExecutor threads without a lock (r3522428847), same for CopilotCliBackend (r3522428850), AzureOpenAIBackend (r3522428852), AzureResponsesBackend (r3522428855)
• [MEDIUM] backend.py: last_call_error not set on Azure backend failures (r3522428858, r3522428860)
• [MEDIUM] harvest_codex.py: per-file parse exceptions abort the whole harvest (r3522428863)
• [MEDIUM] tasks_file.py: list-form tasks file never gets reviewed: true, blocking real-backend runs (r3522428866)

Codacy additionally flagged bandit/flake8-level issues in the same files (see PR #247 Codacy comment); vendored paths are now excluded via .codacy.yml.

Action

• File an issue (or PR) against https://github.com/microsoft/SkillOpt with the findings above
• On the next sync-upstream.sh run, verify whether upstream addressed them

[amondnet]

Additional findings from cubic on PR #247 (also vendored, declined locally — include when reporting upstream):

• [P1] harvest_codex.py _strip_codex_meta: sessions silently dropped when Codex wraps a real prompt in <environment_context> — early return skips text after the closing marker (feat(skillopt-sleep): sync vendored engine to upstream v0.2.0 #247 (comment))
• [P2] replay.py sample_id: cache-collapsed rollouts fixed only for non-tool tasks; tool-required tasks can still collapse to one cached response, zeroing contrastive rollout signal (r3522443061)
• [P2] replay.py replay_batch: non-numeric SKILLOPT_SLEEP_WORKERS crashes via bare int(...) cast — should fall back to 1 like multi_rollout (r3522443062)

[amondnet]

Additional findings from Greptile on PR #247:

• [P1] docs/CLI mismatch: --preferences is documented (upstream plugins/claude-code/commands/skillopt-sleep.md, SKILL.md config table) but not implemented — no argparse arg in __main__.py _add_common(), and cycle.py's get_backend() never forwards a preferences value (only the experiments harness build_backend() wires it). We removed the instruction from our synced docs in 6273f05 — this local doc fix will be overwritten by the next sync-upstream.sh unless upstream fixes it (feat(skillopt-sleep): sync vendored engine to upstream v0.2.0 #247 (comment))
• [P1] harvest_codex.py: missing _is_headless_replay filter — the engine's own CodexCliBackend grader/reflect sessions in ~/.codex/archived_sessions/ pass _is_meta_prompt and pollute the harvested task pool (r3522450456)
• [P2] __main__.py cmd_run: load_tasks_file read twice per --tasks-file run; first result discarded — wasted I/O plus a divergence race if the file changes between reads (r3522450493)