fix(skill): say which stack_config entry the runs read and prove it whole

[using-system]

Summary

The environment check now says which stack_config entry the runs read, and proves an entry whole:

• ## Check step 2 names the degradation when an environment is configured but the resolved key is the plain <stack> entry (or none, falling back to the CLI's active context), and offers persist ... in <env>. A replay's pair is read from the new entry: line of odd_report.py baseline, so /odd-verify no longer resolves it by hand.
• ## Switch: creating an <env>-<stack> entry says it is whole and asks for the stack's other fields or offers to copy the plain entry's values; on the local stack no environment is written and the user is told so (matching fix(mcp): refuse the environment writes that resolve to a wrong or hidden entry #660's server refusal).
• azure-monitor-context.py check proves --subscription and --resource-group too, names every skipped targeting part, and no longer says connected on identity alone (exit 3, routed to the switch).
• cloudwatch-context.py check reports a missing profile / region as an incomplete entry (exit 3) instead of an argparse usage error; the reference states both as required.
• preflight.py probes the configured stack's CLI (from its builtin-stacks.md row) and reports docker daemon unreachable instead of "running nothing" when docker ps fails.
• /odd-config's offer lists the persisted environments; azure-monitor gains the environment change-request forms; docs/guide/backends.md, prompts.md and plugin.md follow.

Choices amended against the issue text (the widened azure identity-only rule, the degradation as a Check rule rather than a script line, the dropped optional discover read, the cloudwatch alignment) are recorded on the issue: #657 (comment)

Tests

• test_preflight.py (daemon unreachable, configured CLI probed or skipped), test_azure_monitor_scripts.py (subscription / resource group proofs, skipped parts named, identity-only not connected; five fixtures captured live and masked), test_cloudwatch_scripts.py (incomplete entry, no aws call), test_odd_report.py (baseline's entry: line in every case, including a custom monitor in environment azure never reading azure-monitor).
• pytest tests/skills tests/hooks 1396 passed after the rebase; ruff 0.16.4 check/format clean; check_stack_reference.py green; apm install --target claude + apm audit green.
• Live: azure-monitor (full entry, rg-only, missing rg, wrong subscription, empty entry) and cloudwatch (full entry, log-group only, no region) verified against real accounts; the preflight across azure-monitor, dynatrace, cloudwatch and datadog configurations.

Review

A separate reviewer sub-agent checked the whole branch under the bound-review rule: no blocking finding in round 1; the one stale fact it noted (the preflight's "about a third of a second") was dropped in round 2; after the rebase on #660/#661/#662 (one conflict in Switch step 3, the baseline entry resolution aligned with #660's parse-back rule and checked side by side with the server on seven configurations), no finding, ready to merge.

Harness measurement

test-plugin-harnessing, copilot / openai/gpt-5.6-luna / medium, /odd-observe drive mission on the local llms-benchmark stack, ABBA, both lab branches rebuilt right before the chain; every changed file in the deployed path.

Side (mean of 2)	Turns	Commands	Tokens in	Tokens out	Wall	Generation	Preflight	Observation
main	44	56.5	3.48 M	17.2 k	439 s	207.5 s	74.5 s	234.5 s
branch	40	39.5	2.72 M	15.7 k	344 s	182 s	63.5 s	151.5 s

Main's spread today over twelve samples: turns 35–46, commands 29–59, tokens in 2.57–3.59 M, wall 310–457 s, preflight 43–78 s. The branch mean is inside or below main's spread on every axis (one branch sample marginally above on turns and preflight, the other below main's minimum on turns, tokens and wall) — no degradation, not claimed as a gain. 1 premium request per sample. The preflight's Machine: line is identical on both sides on the local stack (the configured-stack CLI probe adds nothing there). Every sample persisted its report on the first try.

Closes #657

🤖 Generated with Claude Code