Epic: absorb Lauren Tan's and Matt Pocock's agent workflows (poteto-review) #7555

Brief

Goal. Absorb Lauren Tan's (poteto, pstack) and Matt Pocock's agent workflows into this
marketplace, item by item as the owner decided them, because the owner runs 5-20 sessions and wants
their problem-solving moves (codify on recurrence, non-author verification, narrow ready PRs,
catch-up, grilling, paved paths) working in his own skills and plans (GUIDE D0-D119; register
Q1-Q589).

Scope. The 23 buildable threads of the design record, delivered in its 11-step dependency
order; the 15 deferred threads filed as parked sub-issues (14 issues: Delivery shape is settled by
Q589 and gets none; Cursor compatibility is the active Q579 research item); the probes the design
record requires before adoption; the carried defect fixes Q148 allows. Out of scope: everything the
design record lists as out of scope or declined.

Delivery shape (Q589, GUIDE D119, owner-approved). One epic as spec container; one sub-issue per
buildable thread in dependency order with native blocked-by edges; slice issues under a thread only
where it needs more than one PR; narrow PRs open ready unless a multi-session container (Q501,
Q585); deferred threads as parked sub-issues. Basis: Matt's to-tickets (slices sized to one context
window, blockers first, sub-issues) and Lauren's "prefer five narrow PRs to one large PR".

Hard constraints that bind implementation

• C3: fewer, larger skills with actions and progressive disclosure; cross-skill use only as
  /plugin:skill, never by path.
• C4: tool-neutral via adapters (ADR 0060); configurable defaults in the conventions home.
• C5 as amended by Q567: unattended merge only on a passing verdict from a verifier other than the
  author, once Q519's verifier exists; no report-only phase (D96); Dependabot is required checks
  only.
• C13 (amended, Q575): no agent acts until the owner's intent is codified; recommendations are
  researched against official sources; routine actions follow the research-depth setting, default
  "cite what is in context".
• C14: skills never couple to this repo's own conventions; plugin defaults are fallbacks; project,
  team and user instructions win.
• C15: prefer native mechanisms; inject nothing into a working session the user did not ask for.
• C17: a preference where reasonable consumers differ ships as a setting with a named default,
  basis and scope; fixed floors only tighten (D79, Q574, D96, D88, D100, Q131, the C13 intent gate).
• Evidence before autonomy (GUIDE D1): nothing widens unattended authority (merge, close, write)
  before the probe or eval that gates it passes; a check is recorded only after it fails on a
  planted or past violation and passes after revert (D22, Q115).
• Label the origin: every sub-issue and PR body names the origin of the decision it carries as
  Lauren's, Matt's, owner's, ours or combined.
• Repository rules: AGENTS.md "Code Review Rules" (a skill-body cut ships only with eval evidence
  of no loss; volatile upstream specifics are pointers with as-of date and recheck trigger; ## Next
  sections) and the AGENTS.md stop list (another repo, user-scope config, grant changes).

Acceptance criteria

1. The epic's 23 thread sub-issues are closed by merged PRs, or carry a recorded probe result that
   stops adoption with the owner's sign-off; the 13 parked sub-issues stay open with their reopen
   trigger, and the 1 active Cursor research item (Q579) reports.
2. Every probe the design record requires before adoption has a recorded result on its slice issue
   before the work it gates merges.
3. Every new check ships with its proof script output: fails on the old code, passes on current
   (D22).
4. Every cut to an existing skill body cites before/after eval results in its PR (AGENTS.md).
5. Every setting in the design record's settings table resolves through the config cascade from the
   Settings resolution thread with its named default.
6. No PR merges unattended before the Merge authority thread's verifier and planted-defect run pass.

Assumptions (the design record's captured assumptions 1-14 carry over unchanged; the riskiest
four are probes or questions in this plan):

• A1 (assumption 1): a same-vendor non-author verifier catches enough defects to be the
  only merge gate; settled by the Merge authority thread's planted-defect run.
• A2 (assumption 2, Q586): consumers run GitHub first-class; every GitHub feature degrades through
  an adapter.
• A3 (assumption 3, Q587): plan usage tolerates the added model steps; each step is a setting with
  the per-item usage rollup (Q58) as the measure.
• A4 (assumption 4): the lanes App token broker can mint statuses: write, discussions: write,
  issue-field writes and workflow-triggering pushes; settled by reading the broker (see the
  broker-mint slice): it grants contents, pull_requests and issues only.
• A5: the existing pr-feedback-dispatch.yml lane is the findings lane Q512 describes, so the PR
  pipeline thread reconciles rather than rebuilds it.

Execution shape: per-item PRs