Bring the README and 1.5.0 changelog in line with what shipped (#89)

The changelog section was written early in PR #87 and never caught up. One entry
was also wrong by the time it merged: it said Codex registers a local clone as a
marketplace source, which was tried and reverted in favour of the symlink path
the README documents.

Adds the four user-facing changes that were missing: the fusion-redirect skill,
the token-cache diagnosis behind `connection issue`, the three commands that
reject `--no-prompt`, and the virtualenv setup the OpenAPI adapter needs on
assistants that never run hooks.

The README's skills table was still listing ten skills and omitted
fusion-redirect. fusion-skills lists its mirror-image `foundry-redirect` in the
same table, so this keeps the two repos consistent for anyone comparing them.
The architecture diagram is unchanged on purpose: the orchestrator does not
delegate to fusion-redirect, description-based selection routes to it directly,
so drawing it as a spoke would misrepresent the flow.

Harness work is deliberately left out of the changelog. `--e2e`, `--judge`, the
selection flags and the transcript-parsing fixes are developer tooling, not
user-facing.

Author: mraible

CHANGELOG.md

@@ -8,14 +8,18 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 
 ### Added
 
-- **Install instructions for five AI coding assistants** — Claude Code, Codex, Copilot CLI, Cursor, and Antigravity CLI each get a verified marketplace command, plus an expandable table of local-clone commands for testing a branch. Four of the five load a local clone with a single flag (`--plugin-dir` for Claude Code, Copilot CLI, and Cursor; `agy plugin install` for Antigravity CLI); Codex registers the clone as a marketplace source instead.
+- **Install instructions for five AI coding assistants** — Claude Code, Codex, Copilot CLI, Cursor, and Antigravity CLI each get a verified marketplace command, plus an expandable table of local-clone commands for testing a branch. Four of the five load a local clone with a single flag (`--plugin-dir` for Claude Code, Copilot CLI, and Cursor; `agy plugin install` for Antigravity CLI); Codex has no such flag and discovers skills from `~/.agents/skills/` instead.
+- **`fusion-redirect` skill** — A standalone Falcon Fusion workflow (a trigger plus actions that already exist, with nothing to build) belongs to the sibling Falcon Fusion plugin, and this skill says so. The advisory previously lived in `development-workflow`'s body, behind a trigger description that correctly does not match a Fusion-only request, so assistants that rely on skill descriptions rather than hooks never reached it. As its own skill it is reachable on every assistant. When the Falcon Fusion plugin is installed, that plugin's own skill is the stronger match and handles the request directly.
 - **Agent Plugins manifest** — A root `plugin.json` conforming to the [Agent Plugins](https://agent-plugins.org) 1.0.0 spec, so any conforming client can discover the plugin alongside the existing Claude and Codex manifests. CI validates it and `release.sh` bumps its version with the others.
 - US-3 cloud region to the cloud-region documentation: added `us-3` to the `FOUNDRY_CLOUD_REGION` value lists (headless-operation reference, e2e-testing env var table) and the multi-cloud deployment section. Foundry CLI 2.0.2 added US-3 support; the base URL (`api.us-3.crowdstrike.com`) is in FalconPy as of v1.6.4.
 
 ### Fixed
 
+- **`connection issue` on tenant commands is diagnosed** — In a sandboxed agent the usual cause is a denied write to `~/.config/foundry/token.json`, where the CLI keeps its short-lived access token, not a network fault. The CLI reports only the symptom, so agents were investigating networks and credentials. The debugging skill now explains that the ~30-minute token refresh is expected and that the fix is to request write access to that one directory and retry.
+- **Three commands that reject `--no-prompt`** — `foundry version`, `apps list`, and `apps list-deployments` fail with `unknown flag` when given it. Two of those are in the prerequisite check, so "always add `--no-prompt`" was breaking the first thing an agent runs.
+- **OpenAPI adapter dependencies on assistants that do not run hooks** — The adapter script needs `pyyaml`, and a bare `pip install` fails on Homebrew and system Pythons with `externally-managed-environment` (PEP 668). The API integrations skill documents an explicit virtualenv setup, which assistants without Claude Code's hooks need in order to run the script at all.
 - **Sub-skill routing survives a single-entry-point install** — `development-workflow` now documents that sub-skills live beside it on disk as `../<name>/SKILL.md`, and how to handle a capability-level request that lands on the orchestrator: read the sub-skill from disk first, then skip straight to the CLI command when `manifest.yml` already exists. Assistants that register only the orchestrator no longer have to infer this. The orchestrator's trigger description is unchanged, so skill selection on a fully-registered install behaves exactly as before.
-- **Sub-skills point back to the orchestrator** — All nine sub-skills now link to `development-workflow` near the top of the file, so an assistant without routing hooks that selects a sub-skill directly still finds the CLI prerequisite check, scaffolding order, and manifest coordination. Previously only `e2e-testing` mentioned the orchestrator, and only in a footer.
+- **Sub-skills point back to the orchestrator** — Every capability sub-skill now links to `development-workflow` near the top of the file, so an assistant without routing hooks that selects a sub-skill directly still finds the CLI prerequisite check, scaffolding order, and manifest coordination. Previously only `e2e-testing` mentioned the orchestrator, and only in a footer.
 
 ## [1.4.1] - 2026-08-07
 

README.md

@@ -93,6 +93,7 @@ Other assistants discover and follow the skills but do not run these Claude Code
 | `security-patterns` | OAuth scoping, input validation, content security |
 | `debugging-workflows` | Systematic troubleshooting for CLI, manifest, and deployment issues |
 | `e2e-testing` | End-to-end testing with `@crowdstrike/foundry-playwright` |
+| `fusion-redirect` | Declines standalone Falcon Fusion workflow requests and points to the `crowdstrike-falcon-fusion` plugin |
 
 ## Architecture