docs(changelog): describe split CI steps instead of make all - #3

* rubric: add §8 Hostile-Read Anchors and §9 Contract Enforcement Audit

Two additive sections after the 7-axis scoring scale:

§8 — Hostile-Read Anchors
  Requires evidence-anchored answers for every axis scored ≥ 4 via
  three prompts: (A) weakest claim + falsification evidence,
  (B) misdirected investment check, (C) documented vs. enforced
  contract walk. Includes the §8 tone escape hatch: if an answer
  does not change the score, say why in one sentence.

§9 — Contract Enforcement Audit
  Cross-axis check that maps every documented contract (README,
  SKILL.md, CHANGELOG, commit messages) to its enforcer and scores
  TIGHT / LEAKY / DECORATIVE. Load-bearing axis-cap rule: any
  LEAKY or DECORATIVE contract caps the affected axis at 4 regardless
  of other evidence. Stacks with existing verdict overrides.

Scoring scale (1–5 per axis, /45 total, portability + safety ×2)
is unchanged. Sections are additive; no prior rubric text altered.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* rubric: add evidence-patterns pointer + CHANGELOG entry

evidence-patterns.md: add a pointer paragraph at the end of the
Self-review bias section directing evaluators to rubric §8 and §9
for the misdirected-investment and contract-enforcement checks.

CHANGELOG.md (new file): documents the Unreleased rubric additions
introduced in the companion commit for the 2026-05 audit finding.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore(cyrus): bump maxTurns 60 -> 100 for multi-commit PR flows

The 60-turn budget was tuned for narrow single-step tasks. Multi-commit
PR execution (4-6 commits + final validation + pr-create-from-commits)
realistically needs 80-100 turns end-to-end. Two recent Cyrus runs
(Move A validation enforcement + self-evaluate rubric revision) hit the
60-turn ceiling mid-validation with clean commits already on disk but
no PR opened.

Worktree isolation and role guards remain the primary blast-radius
controls; the turn cap was an artifact of earlier scope, not a safety
mechanism.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(agents-frontmatter-safety): bump cyrus expected maxTurns to 100

Companion to e1f097b: the structural assertion in
tests/agents-frontmatter-safety.bats hardcodes the per-agent
expected maxTurns. Updating cyrus from 60 to 100 to match the
agent definition.

This is exactly the kind of LEAKY-vs-TIGHT contract enforcement
the §9 Contract Enforcement Audit (added in c7b7e37) is meant to
surface — and here the structural test caught the drift before
the commit landed. Working as intended.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

docs(changelog): describe split CI steps instead of make all