fix(repo-fleet-hygiene): correct merged-pr-tip-drift evidence wording

[kyle-sexton]

Closes #2603

Summary

merged-pr-tip-drift evidence claimed drifting tips may never have been pushed, which was false for fleet cases where every tip existed on GitHub.

Fix

Reword evidence to state that the local tip differs from the merged PR headRefOid and that commits may still be on the remote.

Verification

• bash plugins/repo-fleet-hygiene/skills/audit/scripts/audit-fleet.test.sh → all collector tests passed

Related

Refs #2597 — fleet hygiene epic parent.

  

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude finished @kyle-sexton's task in 2m 2s —— View job

---

Code review complete

• Gather context (PR diff, changed files, CLAUDE.md/REVIEW.md)
• Review changed files for correctness/maintainability
• Post findings (inline + summary)

Scope: wording-only fix to the merged-pr-tip-drift evidence string in audit-fleet.sh, with matching test/comment updates and a changelog + version bump. No findings meet the high-signal bar for this lane.

What I checked:

• audit-fleet.sh L1385-L1405: the push_state clause for the non-matching case now correctly avoids asserting the drift commits were never pushed, and states they may still exist on the remote — this matches the stated rationale (post-merge head deletion + prune is the common case, not proof of absence from GitHub).
• audit-fleet.test.sh L586-L594: assertions updated to match the new string, plus a new assert_not_contains "may never have been pushed" regression guard. Fixture data (canonical-a/stale/gone) is unchanged — only comments and assertion text moved, consistent with a pure wording fix.
• Searched the plugin for any other reference to the old "may never/never pushed" phrasing (README.md, confidence-model.md, evals.json) — none exist, so no doc drift was introduced or left behind.
• CHANGELOG.md entry and plugin.json version bump (0.13.0 → 0.13.1) are present and consistent with the plugin's existing changelog conventions.

Not independently verified: the PR description's audit-fleet.test.sh run/pass claim — this lane's tooling doesn't permit executing the test script, so I reviewed the assertions and fixtures by reading rather than re-running them. Treat the "all collector tests passed" claim as author-reported.

Minor (not filed, below the high-signal bar): the new clause (tip differs from merged PR headRefOid; commits may still be on the remote) at L1395 is slightly redundant with the outer message, which already states headRefOid $pr_oid, but current local tip is $tip — a reader gets the "differs" fact twice. Purely a phrasing nit, not a correctness issue.

No inline comments were needed.

[claude]

Claude finished @kyle-sexton's task in 35s —— View job

---

Security review — skipped (no security-relevant surface)

• Gather context (PR diff, changed files, /review:security-review skill instructions)
• Apply skip gate
• Review changed files for security-relevant surface
• Report findings or clear result

Reviewed the full diff (git diff origin/main...HEAD) across all 4 changed files:

• plugins/repo-fleet-hygiene/.claude-plugin/plugin.json — version bump only (0.13.0 → 0.13.1).
• plugins/repo-fleet-hygiene/CHANGELOG.md — changelog entry only.
• plugins/repo-fleet-hygiene/skills/audit/scripts/audit-fleet.sh — changes are confined to comment text and a string-literal evidence message (push_state="..."); no new inputs, no command construction, no eval/exec, no change to what data is collected or how it's sourced (still purely local, no network). Just rewording the human-readable evidence string from "drift commits may never have been pushed" to "tip differs from merged PR headRefOid; commits may still be on the remote."
• plugins/repo-fleet-hygiene/skills/audit/scripts/audit-fleet.test.sh — corresponding test-assertion string updates plus one new assert_not_contains check; test-only.

This is a pure wording/evidence-accuracy fix with no security-relevant surface (no new user input handling, no injection surface, no auth/access-control change, no GitHub Actions workflow permissions touched). Per the skill's skip gate, stopping here — no findings to report.

[github-actions]

Last security-reviewed head: a3d47e8b514e32abbe2ee36eea99073c63067931. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

[claude]

Claude finished @kyle-sexton's task in 40s —— View job

---

Security review — no issues found

• Gather context (PR diff, files changed)
• Invoke /review:security-review
• Post findings / summary

Skip gate applied: this PR's diff (plugins/repo-fleet-hygiene/) has no security-relevant surface. Changes are:

• A version bump in .claude-plugin/plugin.json (0.13.0 → 0.13.1).
• A CHANGELOG.md entry.
• Wording-only edits to a diagnostic evidence string and surrounding comments in audit-fleet.sh (push_state string literal), which is purely display text interpolated into a printed evidence line — never eval'd, never passed to a shell command, no user/network input involved.
• Matching test assertion updates in audit-fleet.test.sh for the new wording.

No injection surfaces, auth/access-control logic, secret handling, or GitHub Actions trigger/permission changes are touched by this diff. No findings to report.

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.