feat(app-control): publish masked CI captures through a hub Mask hand-off and a none: values result #13757

Refs: #11364
Parent: #11364 (done-when rows 1 and 8). session: App Driven PR Verify

Problem

The CI capture publishes no screenshot, so the pr-verify judge sees only run-e2e's pass and fail lines. The #11364 grade shows it: run 42235412941 recorded 12 captures and uploaded 1 file. There are two causes:

1. The hub has no ## Mask. .claude/skills/control-claude-code-plugins/SKILL.md has no ## Mask section, so drive's post-check marks every capture not-checked (plugins/app-control/skills/drive/reference/evidence.md:99-107).
2. Key auth has no account values. claude auth status --json reports "authMethod": "api_key" with no email or orgName (probe 2026-11-06, Claude Code 2.1.319). plugins/harness-ops/skills/control-claude-code/cli/account.mjs then exits 1, and drive treats a failed values: source as not-checked (evidence.md:79-82).

Design (decided; owner decisions on #11364 issuecomment-6689952950 settle the mechanisms)

• Hand-off, not a copy. The hub's ## Mask hands off to the driving control skill's ## Mask, as the hub's other sections already hand off (hub SKILL.md:10-12). The 12 mask lines stay in one place (owner standing direction §6).
  • Resolution rule: the target is the hub named on the hub's Driving tool: line.
  • Trusted root: --trusted-root / trusted-root= covers the target too, so a PR head cannot supply its own masks or values source.
  • Unreadable target: a target that cannot be read leaves every capture not-checked.
• The none: result. A values: cli/ source may print exactly one line, none: <reason>, and exit 0. That source then resolves with no values; this reuses the ## Mask none: grammar (plugins/app-control/reference/control-skill.md:215).
  • The check applies to each source on a values: line.
  • Anything else stays not-checked: a non-zero exit, empty output, or extra lines alongside none:.
  • The reason is recorded in report.json as values_none: [{source, reason}].
• account.mjs prints none: only for key auth. It prints none: API-key auth has no signed-in account and exits 0 only when authMethod is api_key with no email and no organization. An OAuth session with no identity still exits 1. accountValues keeps returning an array: the driver masks with it at capture time (driver.mjs:716-718).

Work: one PR per plugin, in this order

1. app-control (contract):
   • reference/control-skill.md "The Mask section": the hand-off line, its resolution and trusted-root rule, and the none: source result.
   • drive/reference/evidence.md "Mask post-check": follow the hand-off, accept none: per source, record values_none.
   • map/scripts/check-map.sh (and its test): accept the hand-off, and run mask-missing against the resolved target. The fixture is a hub whose Capture lists screenshot and whose Mask hands off.
   • Drive evals:
     • hand-off → applied;
     • unreadable target → not-checked;
     • one none: source → publishable;
     • none: plus a resolved source → the values are scanned;
     • none: plus an extra line → not-checked.
   • Version bump and changelog fragment.
   • The repo hub's ## Mask hand-off line ships in this PR.
2. testing (run-e2e/SKILL.md, Step 5 and lines 124-127):
   • Follow the hand-off when it reads values:, under the same trusted-root rule, and accept none:.
   • Eval: the hub hands off and the target's values: source fails → e2e-summary.json stays out of publishable.
   • Version bump and changelog fragment.
3. harness-ops (control-claude-code):
   • cli/account.mjs prints none: for key auth. Tests at the account.mjs level: key auth with no identity → the none: line, exit 0; OAuth with no identity → exit 1 and empty stdout; unparsable JSON → exit 1.
   • A rewritten key-auth /status fixture, every value invented per .claude/rules/eval-case-transcripts.md, and a maskCells test with no values.
   • Version bump and changelog fragment.

PRs 1 and 2 change skill bodies, so they carry do-not-merge until a valid before/after eval lands (hub rule R379/R381).

Done when

• The app-control PR merges, with drive evals for the hand-off, the unreadable target, a lone none:, mixed sources and an extra line.
• The testing PR merges, with the run-e2e eval in which a failed values: source behind the hand-off keeps e2e-summary.json out of publishable.
• The harness-ops PR merges, and node --test plugins/harness-ops/skills/control-claude-code/driver/driver.test.mjs exits 0 with the account.mjs and key-auth fixture cases.
• grep -n "^## Mask" .claude/skills/control-claude-code-plugins/SKILL.md matches on main.
• bash plugins/app-control/skills/map/scripts/check-map.test.sh exits 0, including the hand-off fixture case.

The live CI capture that shows a published, masked screenshot reaching the judge is #11364's rows 1 and 8. It waits on PR_VERIFY_CLAUDE_API_KEY credit.

Out of scope

• Passing the PR's acceptance criteria to run-e2e in the capture prompt (the feat(harness-ops): verify PR acceptance criteria by driving Claude Code (screenshots, video) before merge #11364 grade, row 1, second gap).