feat(profiles): prune the gstack catalog, add max, honor a removed denylist

Nine gstack skills leave every profile (ship is trunk-based on Gitea,
land-and-deploy auto-merges and deploys, setup-deploy, autoplan reads
paths that do not exist here, context-save has no restore, learn is an
unused parallel store, careful and guard hooks never fired, design-shotgun
needs an absent OpenAI key). lib/gstack-removed.sh is the single denylist;
profile.sh gstack on and toggle-external.sh enable gstack skip it.

full now carries everything every other profile carries (user rule), minus
the parked make-pdf, diagram and 21st-ai/ui-explore/ui-review, which live
in the new max profile together with pr-review-toolkit. The 21st trio also
leaves web, web-full and design (redundant with impeccable + ui-ux-pro-max).

lib/tests/profile-census.test.sh asserts the invariants live and on a
baseline fixture plus one mutant per invariant; gstack-removed.test.sh
covers both restore paths.

lib/profiles/backend.profile

@@ -18,11 +18,8 @@ observability-and-instrumentation  external
 deprecation-and-migration          external
 ci-cd-and-automation               external
 
-# Ship + review + land
-ship
+# Review
 review
-context-save
-land-and-deploy
 
 # Second opinion for hard problems
 codex
@@ -32,11 +29,8 @@ cso
 health
 
 # Session hygiene
-careful
 freeze
 unfreeze
-guard
-learn
 retro
 
 # pr-review-toolkit removed (audit 2026-07-02 #12 — ~2.2k tokens, PR-only):