fix(source-control): close the remaining capability-check misses and false holds #8273

Refs: #8270

Follow-up from the Automation Lanes review of #8270 (owner decision Q641, 2026-10-18). The capability check in plugins/source-control/skills/babysit-prs/scripts/babysit_risk.py scores a SKILL.md, agents/.md or commands/.md diff HIGH when it changes capability frontmatter. #8270 closes four reproduced bypasses; these remain.

Possible misses (may let a capability change through):

• A byte-order mark before the opening --- (medium confidence).
• Nested command files such as commands/sub/x.md are not matched by **/commands/*.md.
• A multi-line ```! block (unverified).

False HIGHs the reviewer reproduced (fail closed, so safe, but they hold PRs a human then merges):

• Body edits to nested lists whose hunk shows no key above them.
• A ! backtick inside a code fence.
• Prose lines that start with Hooks:.

Done when: each miss scores HIGH and each false-HIGH case scores normally, with a test per case, and hold telemetry shows the false-HIGH rate before and after.