review: origin/main baked as default-branch fallback across ~7 surfaces

[kyle-sexton]

Plugin: review · Category: baked repo assumption (1) — low severity
Source: work-readiness sweep (read-only audit vs docs/PLUGIN-PHILOSOPHY.md + docs/MIGRATION-PLAYBOOK.md)

Findings

• plugins/review/agents/code-reviewer.md:20, agents/security-reviewer.md:20, agents/architecture-guardian.md:20, agents/ecosystem-specialist.md:14, skills/fanout/SKILL.md:27, skills/quality-gate/SKILL.md:23, skills/fanout/context/run-everything-mode.md:52 — git merge-base "origin/${PR_BASE:-HEAD}" HEAD … || git merge-base origin/main HEAD … || echo HEAD

Why flagged

Hardcodes main as the default-branch fallback. Guarded behind origin/HEAD + PR base, but origin/HEAD is frequently unset in CI/fetched/shallow clones, so a repo defaulting to master/develop can fall through to a missing origin/main, then to HEAD — producing an empty diff on a clean committed branch (silent no-op review). Against the convention-resolution ladder's "No baked repo assumptions, ever". Same shape as toolchain's <default-branch> gap (#411) — shared fix pattern.

Fix direction

Add a dynamic resolution rung before the literal: gh repo view --json defaultBranchRef or git symbolic-ref refs/remotes/origin/HEAD; keep origin/main only as terminal last resort.