fix: critical bugs, stale refs, README rewrite, security fixes

- Fix evaluator bypass on last story (moved completion check)
- Fix all stale command name references across README, loop.sh, skills, plugin.json
- Fix explore evaluator false rejects (.loop/ files are expected)
- Fix stderr capture order in headless mode
- Fix shell injection risk in hooks.sh python fallback
- Remove .DS_Store from tracking
- Rewrite README to match current architecture (single entry point, tmux, optional tools)
- Add XcodeBuildMCP and iOS simulator MCP to optional tools docs

skills/stories/SKILL.md

@@ -3,7 +3,7 @@ name: stories
 description: "Generate prd.json and sprint contracts by dispatching the planner agent. Does not write source code."
 ---
 
-# /plan — Generate PRD and Sprint Contracts
+# /stories — Generate PRD and Sprint Contracts
 
 Dispatch the planner agent to decompose a spec into stories. The planner agent cannot write source code or run bash commands — it can only write to `.loop/`.
 
@@ -11,7 +11,7 @@ Dispatch the planner agent to decompose a spec into stories. The planner agent c
 
 ### 1. Check prerequisites
 
-Verify `.loop/config.json` exists. If not, tell the user to run `/agent-loop:init` first and stop.
+Verify `.loop/config.json` exists. If not, tell the user to run `/agent-loop:setup` first and stop.
 
 ### 2. Find the spec