Add canonical task-to-PR lifecycle skill

[andrei-hasna]

Scope

• Todos: E-00100 (c4256422-07de-4ac7-9b2a-e4af3be7fc9e)
• Todos plan: a08dc545-512f-43ee-a553-6231a2131c50
• Native plan: 8eadc06b-7276-4854-a6bc-b879866abf6f
• Parent goal/node: 32e0d30d-e05a-45ce-9034-dfc9afeefd1d / e7994834-cd3e-4416-80fc-9e82bb8b59e8
• Acceptance scope: skills-task-to-pr-v2
• Consolidated final repair: cycle 2/2
• Exact head: 7240842f5f31a741fcab02fadfe76bb2129a5aca

Summary

• Keeps agent-skills/ as the canonical tracked source for instruction-only
  fleet workflow skills.
• Hardens task-to-PR route evidence with an immutable resolved route identity
  and admission receipt, lifecycle alias re-resolution, fresh non-reusable
  fencing generations after proven prior-worker/lease revocation, and
  nonce-bound completion events validated against authoritative terminal state.
• Hardens Codewith fleet normalization with exact-path runtime write
  allowlists, subset touched-path ledgers, guarded compare-and-replace or
  create-if-absent writes, drift-safe rollback, and complete repository/package
  provenance in worker output and coordinator acceptance.
• Strengthens the repository-owned Bun gate to enforce the new semantics and
  reject the replaced unsafe forms.
• Retains deterministic two-key Codewith frontmatter, authoritative Machines
  identity, remote-only skill preservation, source/target hashes, rollback
  receipts, and the prior task lifecycle invariants.

No live skill distribution, package version change, publish, release,
deployment, merge, Instructions mutation, or unrelated repository mutation
occurred.

Validation

• bun test src/lib/agent-workflow-skills.test.ts: 4 passed, 131 assertions.
• Relevant instruction/package-boundary tests: 27 passed, 320 assertions.
• Repository-isolated full bun test: 731 passed, 0 failed, 9,862 assertions.
• bun run typecheck: passed.
• bun run build: passed.
• bash scripts/check_skill_corpus_drift.sh --base origin/main: passed.
• bun pm pack --dry-run: passed; release guard passed and agent-skills/
  remained outside the package.
• git diff --check and committed-range diff check: passed.
• Non-printing staged and committed-range secret scans: passed.
• Adversarial self-review, required because nested reviewers were prohibited
  for this repair cycle: no P0-P3 findings after reconciliation.

Post-merge Codewith distribution

After merge, a coordinator uses the tracked
agent-skills/fleet-skill-normalization/SKILL.md workflow with the exact merged
source repository/package, commit, path, SHA-256 hash, and package
version/integrity where applicable. A fresh native Codewith worker resolves
target Machines through authoritative IDs/aliases and live connectivity,
writes only the exact selected target and explicitly named run-owned paths,
verifies subset touched-path evidence and target hashes, preserves remote-only
skills, and returns rollback receipts. Other tool adaptation is separate unless
explicitly scoped.

Rollback

Before merge, close this PR to leave canonical and live state unchanged. After
merge, revert the merge commit. If a later Codewith distribution occurred, use
the tracked normalization workflow from the restored canonical commit and each
recorded preimage/absent-state receipt. Restore only when the current target
still matches the recorded run target hash; otherwise preserve and report the
conflict.

[andrei-hasna]

Exact-head review disposition: both required independent elevated artifacts failed on 7240842, and the PR lifecycle has reached repair cycle 2/2. This PR will not merge. The branch and worktree are preserved for evidence; the combined scope is being split into narrower replacement PR lanes with new frozen acceptance contracts. No third repair/re-review cycle will be run on this PR.