fix(linkedin-studio): ship placeholder voice profile, gitignore real, sentinel detection

Wave 2 / Step 5 of the remediation plan (coupled criticals: voice-leak +
placeholder-detection).

Voice profile (the adopter-default leak):
- Ship a PII-free placeholder at authentic-voice-samples.md carrying a
  <!-- VOICE_PLACEHOLDER --> sentinel + neutral default voice principles.
- Migrate the author's real profile to gitignored authentic-voice-samples.local.md
  (already matched by *.local.md; added an explicit, commented .gitignore entry so
  the intent is unmissable). NO git-history rewrite — the historical file is
  attributed authorship, not a secret (per the plan threat model).
- Add authentic-voice-samples.template.md — a clean fill-in template for adopters.
- personalization-score.mjs: detect the sentinel (deterministic) instead of the
  unreliable `[Your Name]` heuristic, so the placeholder scores 0 voice points and
  a populated profile (sentinel removed) earns the 25.
- Both voice writers replace-not-append on the placeholder: setup.md (merge ->
  replace-if-placeholder) and onboarding.md (append -> replace-if-placeholder), so
  populating removes the sentinel; updated setup.md's stale heuristic table.

Operator decisions (deviations from plan-literal, approved this session):
- KEEP the plugin.json author name. The plan said scrub author -> neutral/org, but
  that contradicts its own LICENSE reasoning (intentional MIT attribution) and all
  5 sibling plugins keep author = the author; scrubbing only this one would create
  inconsistency for zero security gain (the name is public-by-design). The voice
  placeholder fully fixes the adopter-inheritance bug.
- Scrub the stale "January 2026 360Brew" brand from the plugin.json description and
  the "360brew" keyword (locked decision: no publishable model name/date). This is
  a Wave-1 propagation miss surfaced here because plugin.json was in Step 5's
  touch-scope.

Flagged for follow-up (NOT done here — out of Session 2 scope):
- The lint's stat-consistency grep (scripts/test-runner.sh) scans references/,
  commands/, skills/, hooks/prompts/, CLAUDE.md, README.md — but NOT
  .claude-plugin/plugin.json, which is why the 360Brew brand slipped Wave 1.
  Needs a Session-1-scoped lint extension to add plugin.json to the scan set.
- Readers (user-prompt-context.mjs, voice-guardian.md, state-update-reminder.md)
  read the tracked .md (placeholder), per the plan. The operator's real voice now
  lives in the gitignored .local.md, which nothing reads. To use it, readers + the
  voice score should prefer .local.md (matching the user-profile.local.md
  precedent). Deferred as a coherence follow-up for operator review.

Test-first: hooks/scripts/__tests__/personalization-score.test.mjs (red on the
placeholder scoring 25 under the old heuristic, green after the sentinel fix). Hook
suite 62/62, structural lint 0 failed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plugins/linkedin-studio/assets/voice-samples/authentic-voice-samples.template.md

@@ -0,0 +1,61 @@
+# Authentic Voice Samples — Template
+
+Fill this in with YOUR voice, then save it as `authentic-voice-samples.md`
+(or, to keep it out of version control, `authentic-voice-samples.local.md`).
+`/linkedin:setup` can build this for you from 3–5 of your own posts.
+
+Delete every `[bracketed]` prompt as you replace it. Do NOT leave the
+`<!-- VOICE_PLACEHOLDER -->` sentinel anywhere in your finished profile — its
+presence keeps the voice personalization score at 0.
+
+## Core Voice Characteristics
+
+[List 4–6 traits that define how you write. For each: a one-line description and,
+where useful, the patterns you reach for. Examples: solution-oriented, factually
+grounded, story-led, non-judgmental, actionable.]
+
+## Do's
+
+- ✅ [Things that sound like you — openings, structure, language level, how you close.]
+
+## Don'ts
+
+- ❌ [Words, tones, and moves you avoid — buzzwords, em dashes, over-long posts, etc.]
+
+## Signature Phrases
+
+[The phrases you genuinely use to transition into insight or demonstration.
+Keep the list short and real — forced catchphrases read as fake.]
+
+## Vocabulary Preferences
+
+### Terms to always explain on first use
+[Domain acronyms/terms your audience may not know.]
+
+### Words/phrases to AVOID
+[Your personal no-go list.]
+
+## Language Guidelines
+
+- [Which language(s) you publish in, and any accessibility rules — e.g. simple
+  sentences for complex ideas, avoid hard-to-translate idioms.]
+
+## Technical Depth Adaptation
+
+[If you write for multiple audiences, note how depth shifts per audience
+(leaders vs practitioners vs power users).]
+
+## Instructions for Claude
+
+When generating content in this voice:
+1. Start from this profile.
+2. [Your priority order — e.g. "sound like me > optimize for algorithm".]
+3. Verify against the Don'ts list before finishing.
+
+## Update Log
+
+- [YYYY-MM-DD]: Initial voice profile created.
+
+## Collected Post Samples
+
+<!-- Posts are appended here automatically by the Stop hook after sessions where content is created. -->