job6: gstack submodule 070722a→11de390 (v1.52.1.0→v1.58.5.0)

Full pull per user verdict (human review of #2047 gbrowser stealth done,
accepted) — motivated by the #1911 fail-open fix for 4 security guards
(careful, guard, freeze, data-loss) plus PII/secrets redaction (#1797),
telemetry-consent + cache sanitization (#1848).

Gate: make test 90/0 green after bump; re-ran link.sh (symlinks already
current) + gstack ./setup (browse binary rebuilt); smoked /careful and
/freeze (guard's constituents) via direct JSON-payload invocation
(job4 §2.3 idiom) — both confirmed blocking a trivial case (rm -rf,
edit outside freeze boundary) that must be blocked.

Local playwright pin (BDR-029/BLK-008, ubuntu26.04 Chromium support) was
reset by the submodule checkout as designed, then re-applied via
gstack_bump_playwright_if_unsupported's own steps (bun install,
detect unsupported, bun add playwright@latest — 1.58.2→1.61.1, one
minor ahead of the pre-bump local patch). Original local diff backed
up before discarding: scratchpad/gstack-local-playwright-fix-070722a.patch.

plugins.lock.json note updated with the pinned SHA and rationale.

Rollback if needed: git -C skills-external/gstack checkout 070722a &&
git add skills-external/gstack && link.sh re-run.

plugins.lock.json

@@ -13,7 +13,7 @@
   "gstack": {
     "source": "https://github.com/garrytan/gstack.git",
     "managed_by": "git submodule",
-    "note": "Version controlled by submodule pointer in .gitmodules. Update: git submodule update --remote"
+    "note": "Version controlled by submodule pointer in .gitmodules. Update: git submodule update --remote. Pinned at 11de390 (v1.58.5.0, job6): pulled deliberately for the #1911 fail-open security-guard fix (careful/guard/freeze/data-loss guards) after human review of #2047 (gbrowser stealth, accepted). Local playwright bump (BDR-029, BLK-008) is reset by every submodule update and re-applied by install-plugins.sh's gstack_bump_playwright_if_unsupported()."
   },
   "ctx7": {
     "source": "npm:ctx7",