feat(skills): add thin pull-request lifecycle router

[ss-o]

Summary

Refs #668. Agents can discover the review skill but have no shared entry point for the complete PR lifecycle. Add the thin pull-request router requested by ADR-0032 and #668, with a discriminating description and short gates for current-HEAD evidence, authority and handoff.

The canonical PR runbook retains the procedures, branch rules, traceability decisions, review exceptions, merge and post-merge requirements. The new skill reads that runbook locally or from its public source and stops external writes when both are unavailable. Substantive review remains under code-review. This avoids another private or self-contained copy of the procedure.

Instruction impact

1. Classification: optional advisory skill routing, no new policy or enforcement.
2. Consumers: declared Codex, Claude Code, Copilot, Gemini CLI and human consumers in the canonical organization repository. Declaration is not actual runtime discovery or downstream delivery.
3. Canonical owner: runbooks/pull-requests.md owns the lifecycle; code-review owns substantive review execution under the runbook, and ADR-0032 owns the architecture.
4. Duplication: no branch expressions, review markers, class exceptions or detailed workflow copied into the skill. Existing issue, review and learning skills retain their roles.
5. Routing: add only skill-pull-request, scoped to the pull-request task, with the established supported-consumer list. No private manifest or downstream routes change.
6. Mandatory delivery: AGENTS and the required PR runbook remain mandatory without the optional skill. The skill is advisory and claims no canonical policy ownership.
7. Generated output: no baseline, adapter, generated artifact or approved pin changes. Public validators use tracked source plus the new skill; task-generated runtime carriers are excluded. Private generation, size limits and actual runtime discovery remain separately scoped, not claimed verified here.

Verification

• Skill frontmatter validation and public policy/routing/provenance/ADR/Zsh validators: passed.
• Only one advisory manifest entry is added; the existing manifest entries remain identical. Local runbook and review owners resolve.
• History-dependent approved-provenance test: passed in the actual checkout.
• Existing instruction suites: 251 tests, 250 passed and one history-dependent case skipped in the tracked-source snapshot. That case passed separately in the actual checkout.
• Scoped Trunk 1.25.0 check --no-fix on both changed files: passed.
• All 12 hosted checks passed on f9cc6a2d. Current-HEAD fallback review posted and read back; no actionable findings. GitHub rendering checked at desktop and mobile widths, expanded and collapsed without horizontal overflow.
• Complete local diff reviewed for ownership, authority, current-HEAD gates and compatibility; no known actionable findings.

Compatibility and follow-up

This is a two-file canonical-source change. No dependency, enforcement, approved-pin, downstream install, credentials or settings change. The public runbook fallback supports repositories lacking a local copy. The code-review-only exclusion keeps this lifecycle entry point from replacing the existing review skill.

Keep #668 open: Project tracker routing, runtime delivery, reference-integrity checks and the retained issue-skill reference audit remain. No new project direction or implementation of those follow-ups is included.

Agent handoff

The local router phase is implemented and the maintainer authorized reopening #668, its prepared progress note, routine issue/PR labels and Project progress, commit/push, draft publication and fallback review without a Copilot request. Hosted CI passed and the current-HEAD fallback review is posted with no actionable findings. The issue is open and In Progress; this draft is In Review. Remaining #668 work stays recorded for later scoped phases. Stop for the maintainer's merge decision; no pins, downstream installs or later-phase implementation are included.

[ss-o]

Fallback review under ADR-0026: maintainer elected, no Copilot request on f9cc6a2

Findings

No actionable findings in the latest commit or the complete two-file diff. Reviewed under the canonical code-review skill and generic review criteria.

Note

This is a maintainer-elected self-review, not an independent review or approval to merge.

Validation

• Source checks: skill frontmatter, public policy, routing, approved provenance, ADR and Zsh-policy validators passed. Trunk 1.25.0 passed on both changed files.
• Tests: 250 passed in the tracked-source snapshot; its one history-dependent case passed separately in the actual checkout. Hosted instruction validation passed; hosted Org Routing ran the history-dependent suite without skips.
• CI: All 12 checks passed on the reviewed HEAD. Annotations contain only recorded link-cache permission warnings and Ubuntu migration notices.
• Metadata: #668 is open and Project 28 In Progress, with type:maintenance and area:meta. This draft has type:feature, area:meta and Project 28 In Review.

Checklist verdicts and evidence

• Correctness: pass. The entry point requires the local canonical PR runbook or its public source and stops external writes if neither is accessible. It covers lifecycle routing, current-HEAD evidence and handoff without replacing substantive code review.
• Authority and security: pass. Git, publication, review and metadata mutations require approved scope. Tool or skill availability grants no authority. No credentials, settings, workflow permissions or executable shell behavior change.
• Compatibility: pass for this scope. One optional advisory manifest entry uses established consumers and the pull-request task. Existing entries, mandatory routing, dependencies and approved revisions are unchanged. No public API, Zsh compatibility floor or plugin lifecycle changes.
• Maintainability: pass. The runbook owns branch, traceability, review and post-merge procedures. The skill adds no copied branch patterns, fallback markers or exemption rules. Its description directs code-only review to the existing review skill.
• Coverage: pass. Reviewed the complete published diff against the approved scope, resolved canonical owners, inspected current CI logs and annotations, and confirmed zero existing review threads. The canonical review skill validates and matches its approved source content.

Limits and follow-up

Runtime discovery and downstream delivery are unverified and outside this PR. Manifest consumers declare intent, not delivery. No independent review was performed.

Keep #668 open for Project tracker routing, delivery, reference-integrity checks and the retained issue-reference audit. Those follow-ups are recorded in the issue and workspace notes. This scoped phase is ready for the maintainer's merge decision.