feat: v1.4.0 audit fixes, multi-agent compatibility, Bases dashboard

External audit flagged 8 actionable items against current best practices for
Agent Skills, Claude Code hooks, Obsidian v1.9-v1.12, and JSON Canvas 1.0.
This release addresses all of them and adds multi-agent compatibility files
at zero cost to existing users.

Tier 1, critical fixes:

* wiki/meta/dashboard.base: NEW Obsidian Bases dashboard (native, no plugin
  needed). Replaces Dataview as the primary dashboard. Six views: Recent
  Activity, Seed Pages, Entities Missing Sources, Open Questions,
  Comparisons, Sources.
* wiki/meta/dashboard.md: now embeds dashboard.base. Legacy Dataview queries
  retained as optional fallback for users on Obsidian < 1.9.10.
* README.md and skills/wiki/references/plugins.md: Plugins section
  reorganized to recommend Bases (core, no install) primary, Dataview
  optional/legacy.
* skills/canvas/references/canvas-spec.md: added missing JSON Canvas 1.0
  fields. Group nodes now document background and backgroundStyle (cover,
  ratio, repeat). Edges document fromEnd (default 'none') and toEnd
  (default 'arrow') asymmetric defaults. Hex ID convention noted alongside
  descriptive ID alternative.
* .gitignore: track wiki/meta/dashboard.base explicitly.

Tier 2, important improvements:

* hooks/hooks.json: SessionStart now uses both command type
  ([ -f wiki/hot.md ] && cat ...) and prompt type. Command type is the
  canonical safety check that works in non-vault sessions without erroring.
  Matcher: startup|resume.
* hooks/hooks.json: NEW PostCompact hook re-injects hot cache after context
  compaction (hook-injected context does not survive compaction; CLAUDE.md
  does).
* hooks/hooks.json: PostToolUse auto-commit now guarded by [ -d .git ].
* hooks/README.md: NEW documentation including known plugin-hooks STDOUT bug
  (anthropics/claude-code#10875) and workarounds.
* skills/wiki/references/mcp-setup.md: added Option D (Obsidian CLI) for
  v1.12+. Added warning callout above NODE_TLS_REJECT_UNAUTHORIZED line
  explaining process-wide TLS bypass and recommending Option D as the
  secure alternative.
* skills/wiki-ingest/SKILL.md: documented [!contradiction] custom callout
  CSS dependency on vault-colors.css snippet.
* skills/wiki/references/css-snippets.md: full documentation of all four
  custom callouts (contradiction, gap, key-insight, stale) with built-in
  fallback equivalents.

Tier 3, multi-agent compatibility (low complexity, high reach):

* AGENTS.md: Codex CLI / OpenCode bootstrap.
* GEMINI.md: Gemini CLI / Antigravity bootstrap.
* .cursor/rules/claude-obsidian.mdc: Cursor always-on rules.
* .windsurf/rules/claude-obsidian.md: Windsurf Cascade rules.
* .github/copilot-instructions.md: GitHub Copilot conventions.
* bin/setup-multi-agent.sh: idempotent symlink installer for Codex,
  OpenCode, Gemini, Cursor, Windsurf. Wires up the skills/ directory in
  each agent's expected location.

Style cleanup: scrubbed all em dashes from every skill, hook, doc, and
bootstrap file (249 total replacements across 26 files). Skills now use
periods, commas, and colons throughout for cleaner natural prose.

Version: 1.3.0 to 1.4.0 (aligns plugin.json with GitHub release tag format).

Already resolved in v1.1 (no action needed):
* defuddle, obsidian-bases, obsidian-markdown skills shipped
* URL ingestion, vision ingestion, delta tracking docs
* Multi-depth wiki-query (Quick / Standard / Deep)
* PostToolUse auto-commit hook
* allowed-tools field removed from all SKILL.md files
* All templates already use plural tag/alias forms
* Custom callouts CSS already in vault-colors.css

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

hooks/README.md

@@ -0,0 +1,26 @@
+# claude-obsidian Hooks
+
+Plugin hooks for the claude-obsidian wiki vault. All hooks are defined in `hooks.json`.
+
+## Events
+
+| Event | Type | Purpose |
+|---|---|---|
+| `SessionStart` | command + prompt | Loads `wiki/hot.md` into context. Command type runs `[ -f wiki/hot.md ] && cat wiki/hot.md` as the canonical safety check (works for non-vault sessions without erroring). Prompt type complements with semantic context restoration. Matcher: `startup\|resume`. |
+| `PostCompact` | prompt | Re-loads `wiki/hot.md` after context compaction. Hook-injected context does NOT survive compaction (only `CLAUDE.md` does), so this hook restores the hot cache mid-session. |
+| `PostToolUse` | command | Auto-commits any wiki/ or .raw/ changes after Write or Edit tool calls. Guarded by `[ -d .git ]` so it never errors in non-git directories, and by `git diff --cached --quiet` so it never creates empty commits. |
+| `Stop` | prompt | Updates `wiki/hot.md` at the end of every Claude response with a brief summary of what changed. |
+
+## Known Issue: Plugin Hooks STDOUT Bug
+
+`anthropics/claude-code#10875` documents that **plugin hook STDOUT may not be captured** by Claude Code, while identical inline hooks in `settings.json` work correctly.
+
+**Impact**: If this bug is active in your Claude Code version, the prompt-type SessionStart and PostCompact hooks may not inject context as expected.
+
+**Workaround**: The command-type SessionStart hook (`cat wiki/hot.md`) is the canonical safety check. It relies on STDOUT capture for context injection, so test against this issue if hot cache restoration fails. As a fallback, copy the hook config from `hooks.json` into your user-level `~/.claude/settings.json` instead of relying on plugin hooks.
+
+**Test for the bug**: After installing the plugin, open a fresh Claude Code session in a directory containing a populated `wiki/hot.md`. Ask Claude "what's in the hot cache?". If Claude has no idea, the STDOUT bug is active in your version.
+
+## Non-Vault Sessions
+
+The SessionStart command hook uses `[ -f wiki/hot.md ] && cat wiki/hot.md || true` so it always exits 0, even when no vault is present. This makes the plugin safe to install globally without breaking non-vault Claude Code sessions.