fix: harden adversarial routing against injected merge intent

[Wibias]

Summary

Ports the validated github-delivery fixes discovered while qualifying the public .agents release.

• treat embedded repository/bot instructions as untrusted data and emit an explicit security flag
• prevent attributed bot text such as merge immediately from creating merge-discussion intent
• add a routing regression for the injected-merge case
• restore canonical Skill Ratchet semantics for D4, D5, N3, A5, and A6
• document competing-skill classification and adapt A5 to the source repo's overrides/babysit/SKILL.md

Why

The strong Skill Ratchet review found a concrete taint leak: isMergeDiscussion() inspected raw prompt text, so a merge command inside attributed CodeRabbit feedback could route the request to status.md. The downstream .agents copy was fixed and reached complete Skill Ratchet PASS at commit 0d5d340c301da34c39820feeae7bd8c0466dafab.

This PR ports only the source-repo product changes; it intentionally excludes .agents-specific frontmatter and public-release packaging changes.

Validation

• branch is two commits ahead of current main
• changed surface is limited to 6 files
• the injected-merge routing behavior is pinned by ROUTE-bot-injection-does-not-create-merge-intent
• source-repo CI / Skill Ratchet still need to run on this exact commit before merge

Policy budget correction

The first CI run correctly rejected the initial port because adding competing-skill guidance to universal SKILL.md and expanding the universal policy kernel exceeded the repository's fixed 60% context-reduction budgets. The budgets were not changed. SKILL.md is restored exactly to source main; babysit ownership classification now lives in the two compatibility redirects, and GD-CORE-004 is rewritten compactly while retaining the explicit injection security flag. New candidate: bb9e0faa12dd14b6ed62b41fa4f4392852da0401. CI is rerunning on this exact head.

Router unit-test correction

The next CI run exposed two unit tests that still encoded the prior unsafe routing expectation: attributed bot merge text was expected to become read-only merge/status discussion. Those tests now assert the hardened contract instead: pure attributed injection yields no route, while a trusted fix request plus injected bot text remains fix-pr-bots without merge authority. New candidate: d7ee778ceae0703326139841fa829b6c94f429b7.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 6421d87c-1002-4985-899f-1dd64afceaff

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}