feat(profiles): prune the gstack catalog, add max, honor a removed denylist

Nine gstack skills leave every profile (ship is trunk-based on Gitea,
land-and-deploy auto-merges and deploys, setup-deploy, autoplan reads
paths that do not exist here, context-save has no restore, learn is an
unused parallel store, careful and guard hooks never fired, design-shotgun
needs an absent OpenAI key). lib/gstack-removed.sh is the single denylist;
profile.sh gstack on and toggle-external.sh enable gstack skip it.

full now carries everything every other profile carries (user rule), minus
the parked make-pdf, diagram and 21st-ai/ui-explore/ui-review, which live
in the new max profile together with pr-review-toolkit. The 21st trio also
leaves web, web-full and design (redundant with impeccable + ui-ux-pro-max).

lib/tests/profile-census.test.sh asserts the invariants live and on a
baseline fixture plus one mutant per invariant; gstack-removed.test.sh
covers both restore paths.

lib/tests/profile-set-managed.test.sh

@@ -19,7 +19,8 @@ for g in gs-a gs-b gs-c; do
   mkdir -p "$FX/skills-external/gstack/$g"
   touch "$FX/skills-external/gstack/$g/SKILL.md"
 done
-cp "$ROOT/lib/profile.sh" "$ROOT/lib/toggle-external.sh" "$FX/lib/"
+cp "$ROOT/lib/profile.sh" "$ROOT/lib/toggle-external.sh" \
+  "$ROOT/lib/gstack-removed.sh" "$FX/lib/"
 
 # Non-managed external, enabled from the start — must never be touched.
 ln -s "$FX/skills-external/other-ext" "$FX/skills/other-ext"