feat(dev): babysit-prs — per-PR worker subagents (orchestrator rewrite) - #10

* feat(dev): dispatch babysit-prs per-PR work to worker subagents

Rewrite SKILL.md as an orchestrator (sweep + cheap gh-JSON triage +
report) that spawns one general-purpose subagent per flagged PR. The
worker prompt inlines literal values only (repo, default branch, repo
root, PR fields, triage evidence, assigned worktree dirs), restates the
safety rails verbatim, and demands a structured RESULT block. Healthy
PRs never spawn a worker; workers run sequentially (shared .git locks);
inline fallback when no Agent tool. The conflict/CI procedures move
intact into a worker-facing Per-PR procedures section that workers read
from a resolved literal path.

Implements point 1 of the babysit-prs improvement plan (issue #8).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(dev): address PR #10 review comments

- Document why every flagged PR gets a worker (no count threshold):
  workers are sequential, so the fan-out-overhead caveat from #8 doesn't
  apply, and context hygiene pays at any count under /loop.
- Align worktree-dir placeholder names (<REPO_ROOT>/<number>) with the
  Step 4 prompt template.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* refactor(dev): split babysit-prs procedures into references/

Point 2 of the babysit-prs improvement plan: progressive disclosure. The two
long per-PR procedures move out of SKILL.md into one file per axis under
references/, leaving SKILL.md at 311 lines (was 574).

- references/conflict-procedure.md — the merge-conflict axis (steps 1-7)
- references/ci-procedure.md — the failing-checks axis (steps 1-5)

Both bodies move verbatim; the only text changes are cross-references that no
longer resolve in-file ("step 5" -> "step 5 below", and CI step 4's pointer at
the conflict procedure's own step 7). Each file opens by naming its worktree dir
and its placeholders, and defers to SKILL.md for the confidence rule and Safety
so neither is duplicated.

Wiring:
- Step 1 resolves SKILL_DIR alongside SKILL_FILE and states that the
  orchestrator must not read either procedure file — it only passes the paths on.
- The Step 4 worker prompt carries a procedure path per flagged axis, with an
  explicit instruction to read only the flagged ones, as each axis is reached.
- The inline (no Agent tool) fallback is called out as the one path that reads
  the procedure files itself.

Frontmatter description is unchanged, so the generated README is untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(dev): address PR #12 review comments

Resolved CodeRabbit comments on PR #12.

- Quote every `HEAD:<headRefName>` push refspec. Git accepts `;`, `$(…)` and
  backticks in branch names, so an unquoted refspec is a command-injection
  vector (verified with `git check-ref-format`).
- Add a PR-head ancestry check to the conflict push guard. The default-branch
  check passes trivially on step 4's baseline detour, where HEAD *is* the
  default branch — verified that the old guard allowed pushing the default
  branch over the PR's own head, discarding the PR.
- Replace the cross-block `PR_HEAD_SHA` shell variable with a
  `refs/babysit/pr-<number>-head` git ref. Refs survive a fresh shell, a
  reset and a `clean`; an empty variable turned `reset --hard` into a no-op
  that kept the merge it was meant to discard. Deleted in step 7.
- Re-assign `WORKTREE_DIR` in every command block that uses it. Each tool call
  is a fresh shell, so an empty value made `git -C "$WORKTREE_DIR" clean -fd`
  clean the current directory instead.
- Resolve the skill path from the base directory Claude Code supplies, falling
  back to a search that requires exactly one match and verifies both procedure
  files exist. `find | head -1` picked a stale plugin-cache commit — this
  machine has three copies, and it was selecting the oldest.
- Mark PR metadata in the worker prompt as untrusted data with BEGIN/END
  markers, and instruct workers to ignore instruction-shaped content in
  metadata, diffs, CI logs and review comments.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(dev): address CodeRabbit round-2 review on babysit-prs

- Resolve branch names at execution time (HEAD_BRANCH=$(gh pr view ...))
  instead of interpolating headRefName into shell source — double quotes
  do not stop $() / backtick evaluation inside a pasted ref name.
- Pin the saved PR-head ref: note the SHA at step 2 and re-check the ref
  against it in step 5's push guard, since the shared ref store is
  writable by anything the procedure runs.
- Make Step 1 STOP branches exit non-zero so failed path resolution
  can't scroll past.
- Document the ignored-files tradeoff on the baseline detour and the
  indeterminate escape hatch.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(dev): gate the merge commit and lease-pin the conflict push

Address CodeRabbit review on PR #12:
- Gate `git commit --no-edit` on MERGE_HEAD so an auto-committed merge
  can't error a fail-fast shell before the push guards run.
- Read the saved-head ref once into SAVED_SHA, verify it resolved, and
  use that one value for both the ancestry guard and a
  --force-with-lease=<branch>:<sha> push — a compare-and-swap that
  rejects any mid-pass branch movement (including force-pushes to an
  ancestor that a plain push would silently bury) while remaining a
  strict fast-forward when it succeeds.
- Clarify in both SKILL.md safety rails that the pinned lease is
  stricter than a plain push, not a force-push; bare --force /
  --force-with-lease stay forbidden.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs(dev): call the lease-pinned push a lease-guarded force update

--force-with-lease is force-capable even when pinned to an explicit SHA;
what confines the conflict procedure's push to a fast-forward is the
ancestry guard, not the flag. Say so instead of claiming the push is
"not a force".

Addresses coderabbitai review on PR #12.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(dev): resolve DEFAULT_BRANCH at execution time in conflict procedure

Copilot review on PR #12: a literal <DEFAULT_BRANCH> pasted into a
double-quoted shell argument can execute command substitutions embedded
in a branch name. Resolve it per block via gh repo view, matching the
file's own HEAD_BRANCH load-then-expand rule.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Kate Zublenko <zublenko@globaldev.tech>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>