docs: add unified technical, product and security assessment

[smusali]

Adds docs/GITCO-UNIFIED-ASSESSMENT.md — a single document unifying three separate assessments of this project, with every claim cross-verified against the working tree at d71824a.

Contents

Section	Covers
Part 0	Measured vitals, source inventory, the actual registered command tree, per-command runtime results, forensic timeline, dimensional scorecard
Part 1	Unified 50-finding severity ledger (P0 → P3)
Part 2	The six P0 findings, with reproductions and fixes
Part 3	Security: credential handling, CI gating, archive restoration, exception handling, worktree detection, prompt injection, and the trust bar for asking maintainers to run this
Part 4	Architecture: layer contracts, module size, HTTP stacks, dependencies, configuration, target structure
Part 5	Code quality, typing, toolchain, the missing test architecture, the required CI pipeline
Part 6	Documentation truthfulness — documented-vs-actual command and flag diff
Part 7	The AI/intelligence layer
Parts 8–9	Product positioning, competitive field, and the intelligence moat
Parts 10–11	CLI/UX design, distribution, release, supply chain
Parts 12–13	Phased roadmap, version milestones, 50-item prioritized fix list
Parts 14–18	What to delete/demote/rewrite, what is genuinely good, metrics, doctrine, bottom line
Appendices	Reproduction commands; files requiring change

Verification notes

Claims were re-derived from the source rather than carried over between assessments. That produced three corrections and two additions:

• The utils/completion.py broken imports are from ..config import get_config_manager (relative), not absolute — still broken, since gitco.config does not exist, and silently swallowed by except Exception: pass.
• discover --personalized, --show-history, and --min-confidence do exist; discover --repo does not (the real flag is --repos).
• ruff --select ALL reports 2,874 violations in src/; the project's current 7-family configuration reports "All checks passed!"
• New finding (F-08): curl -w writes its format string after the response body, so SSHGitHubClient._make_ssh_request parses lines[0] as the status code when it is actually the first line of JSON. Every request through that client fails unconditionally with a misleading error. Verified against live curl output.
• New finding (F-13): BackupManager._restore_repository joins archive-supplied paths to the destination with no containment check (Zip Slip / CWE-22), and accepts an overwrite_existing parameter it never consults.

Documentation only — no source, configuration, or workflow changes.

🤖 Generated with Claude Code