Undisclosed hourly GitHub network call in every skill preamble (update-check) #1081

Summary

Every gstack skill preamble runs `gstack-update-check`, which on cache miss (~every 60 minutes) makes a GET request to:

https://raw.githubusercontent.com/garrytan/gstack/main/VERSION

This happens regardless of the user's `telemetry` setting — including when `telemetry: off` is set. The request is never disclosed in the README privacy section, the telemetry consent prompt, or the setup flow.

Why this matters

The telemetry consent UI describes what data is sent to Supabase. A user who sets `telemetry: off` reasonably expects no outbound network activity tied to gstack usage. But the GitHub fetch still fires, exposing their IP address to GitHub once per hour during active sessions.

When telemetry is non-`off`, the slow-path fetch also fires a secondary Supabase POST:

curl -X POST "${SUPA_URL}/functions/v1/update-check" \
  -d "{\"version\":\"$LOCAL\",\"os\":\"$_OS\"}"

This Supabase ping is correctly gated on telemetry opt-in, but the GitHub fetch is not.

Affected location

`bin/gstack-update-check`, Step 4 (slow path):

REMOTE="$(curl -sf --max-time 5 "$REMOTE_URL" 2>/dev/null || true)"

The update check cache TTL is 60 minutes for `UP_TO_DATE` results and 720 minutes for `UPGRADE_AVAILABLE`. So in a typical day of active gstack use this fires roughly once per working session.

Proposed fix

Add one sentence to the README privacy section and the telemetry consent prompt that covers the update check:

Update checks: Once per hour, gstack fetches the current version number from GitHub to check for updates. This is a plain GET request that reveals your IP to GitHub. Set `update_check: false` to disable it entirely.

The `update_check: false` escape hatch already exists — it just isn't mentioned near the privacy disclosure.

No code change needed if the fix is documentation only. If the team prefers to gate the GitHub fetch behind the telemetry consent (rather than just document it), that's a separate call.