fix: skip third-party paths (winget-pkgs, HOL) in dispatch-runner

Adds THIRD_PARTY_PATHS exclusion list so fix scripts never modify
code that isn't ours (Microsoft winget-pkgs, HOL Theorem Prover, etc.).
Also adds shared lib/third-party-excludes.sh for fix scripts to source.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Jonathan D.A. Jewell

scripts/dispatch-runner.sh

@@ -57,6 +57,14 @@ REPOS_BASE="${REPOS_BASE:-/var/mnt/eclipse/repos}"
 FLEET_SCRIPTS="${FLEET_SCRIPTS:-/var/mnt/eclipse/repos/gitbot-fleet/scripts}"
 RRA_BIN="${RRA_BIN:-/var/mnt/eclipse/repos/gitbot-fleet/robot-repo-automaton/target/release/robot-repo-automaton}"
 
+# Third-party subdirectories inside monorepos that must NOT be modified.
+# Fix scripts will skip these paths entirely.
+THIRD_PARTY_PATHS=(
+    "developer-ecosystem/package-publishers/winget-pkgs"
+    "developer-ecosystem/package-publishers/macports-ports"
+    "echidna/HOL"
+)
+
 # Try hypatia's data first, then fall back to central verisimdb-data
 if [[ -f "${HYPATIA_DATA}/dispatch/pending.jsonl" ]]; then
     MANIFEST_PATH="${HYPATIA_DATA}/dispatch/pending.jsonl"
@@ -193,6 +201,16 @@ execute_entry() {
         return
     fi
 
+    # Skip third-party paths that must not be modified
+    local rel_repo_path="${repo_path#"$REPOS_BASE"/}"
+    for tp in "${THIRD_PARTY_PATHS[@]}"; do
+        if [[ "$rel_repo_path" == "$tp" || "$rel_repo_path" == "$tp/"* ]]; then
+            echo "  SKIP: $repo (third-party path: $tp)"
+            ((SKIPPED++)) || true
+            return
+        fi
+    done
+
     # Skip if repo doesn't exist locally
     if [[ ! -d "$repo_path" ]]; then
         echo "  SKIP: $repo (not found at $repo_path)"

scripts/lib/third-party-excludes.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: PMPL-1.0-or-later
+#
+# third-party-excludes.sh — Shared exclusion list for fix scripts
+#
+# Source this to get FIND_THIRD_PARTY_EXCLUDES for use with find commands.
+# These are directories containing third-party code that must not be modified.
+
+# Third-party / vendored directories to always skip
+THIRD_PARTY_SKIP_DIRS=(
+    .git target node_modules _build .lake deps
+    vendor dist build __pycache__ .tox .mypy_cache
+    winget-pkgs
+    macports-ports
+    compiler-source
+    HOL
+    .elixir_ls .hex .mix
+    coverage .cache .parcel-cache
+)
+
+# Build find -not -path exclusions
+FIND_THIRD_PARTY_EXCLUDES=()
+for d in "${THIRD_PARTY_SKIP_DIRS[@]}"; do
+    FIND_THIRD_PARTY_EXCLUDES+=(-not -path "*/${d}/*")
+done