[gurnben]

Summary

The init wizard asked users to pick a scanner toolchain profile before they could know what they would run — and the answer is deterministic anyway: the secure-code-audit profile's toolset is a superset of the vuln-scan and triage profiles, so one profile covers every stage of every flow (audit and verify use its scanners; triage and patch need nothing beyond it).

• init installs secure-code-audit by default — the wizard question is gone; --toolchain none remains the explicit opt-out; already-installed profiles are skipped so re-init stays fast.
• Per-run pre-flight: every run (and therefore every flow stage) whose skill has a toolchain profile gets a cheap admin toolchain doctor check; an incomplete profile surfaces as a non-fatal warning naming the profile, the coverage cost ("the skill will run with reduced scanner coverage"), and the fix (traust-cli init). Degraded audits now say why they're degraded instead of silently producing thinner evidence.
• The skill→profile mapping ships in the standalone profile (toolchain: field), alongside the existing role/min-model data.
• Bonus fix: run ids widened to a 6-hex random suffix — the 4-hex suffix collided ~8% of the time once a dozen runs shared a second (surfaced by the uniqueness test going flaky under repeated CI runs), and a collision meant a shared run directory.

Verification

• Live against the real workspace: the pre-flight fired on its incomplete profile (6 missing tools), and the default install brought 7 of 8 tools healthy — one version-pinned govulncheck upgrade remains operator-side (go install golang.org/x/vuln/cmd/govulncheck@latest).
• Tests: the warning path (fires, names the fix, non-fatal), the clean path (no warning), and id uniqueness across repeated suites.
• Full suite ×3 with race detector, vet, staticcheck clean.

💘 Generated with Crush