docs(grill): adversarial review — 15 challenges, 2 MUST, 4 FIX, 7 ACCEPT

G-101 MUST: GITEA_TOKEN injection chain broken (hookscript on host, token in CT env)
  → Fix: bake token into snippet at staging time
G-102 MUST: PRAXIS_DB_PATH never read by server (db/store.py, db/migrate.py hardcode path)
  → Fix: add os.environ.get('PRAXIS_DB_PATH', 'praxis.db') in 2 files
G-103 FIX: 5 missing env vars in injection list (OLLAMA_CHAT_URL, CARTESIA_VOICE_ID, etc.)
G-104 FIX: health-check timeout 300s→600s (zero margin vs 5min build)
G-105 FIX: Dockerfile pip install runs before source copy (build fails)
G-106 FIX: bats test count 9→10 (MH-26 + Makefile)

Verdict: APPROVE_WITH_NOTES — plan sound with 6 fixes applied in EXECUTE

---ci---
project: praxis
phase: 0
milestone: v0.2
status: grill
---/ci---

.ciagent/CHECKPOINT.json

@@ -1,14 +1,25 @@
 {
   "phase": 0,
-  "stage": "plan",
+  "stage": "grill",
   "milestone": "v0.2",
   "phase_role": "pre_execution",
   "attempts": 0,
-  "updated_at": "2026-08-01T14:25:00Z",
-  "plan_summary": {
-    "slices": 10,
-    "waves": 4,
-    "tasks": 34,
-    "req_coverage": "20/20"
+  "updated_at": "2026-08-01T14:35:00Z",
+  "grill_summary": {
+    "challenges": 15,
+    "binding_decisions": 13,
+    "must": 2,
+    "fix": 4,
+    "accept": 7,
+    "escalations": 0,
+    "verdict": "APPROVE_WITH_NOTES"
+  },
+  "binding_actions": {
+    "G-101": "MUST: bake GITEA_TOKEN into snippet at staging time",
+    "G-102": "MUST: add PRAXIS_DB_PATH env read to db/store.py + db/migrate.py",
+    "G-103": "FIX: add 5 missing env vars to injection list",
+    "G-104": "FIX: bump health-check timeout 300s→600s",
+    "G-105": "FIX: fix Dockerfile pip install copy ordering",
+    "G-106": "FIX: fix bats test count 9→10"
   }
 }