fix(repo-fleet-hygiene): defer reclaimable-worktree to source-control

[kyle-sexton]

Closes #2605

Summary

reclaimable-worktree duplicated source-control:worktree's stranded-work axis with a weaker signal.

Fix

Demote/retire reclaimable-worktree emissions in favor of source-control ownership / handoff so fleet findings do not undercut the stronger stranded-work classifier.

Verification

See collector tests on PR checks.

Related

Refs #2601 — ignored-files safety on reclaimable classification.
Refs #2597 — fleet epic.

  

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude finished @kyle-sexton's task in 1m 44s —— View job

---

Security review

• Gather context (PR diff, changed files, CLAUDE.md)
• Invoke /review:security-review per custom instructions
• Post findings

No security issues found.

Reviewed the full diff (302a6fa...f21dbf3) against the /review:security-review skip gate and criteria:

• The change is confined to the repo-fleet-hygiene plugin: a read-only fleet audit script (audit-fleet.sh), its test file, and docs/changelog/plugin metadata.
• Net effect: removes git status --porcelain from the git_probe_allowed exact-match allowlist (L149-151 old) and retires the reclaimable-worktree / worktree-disposability-unverifiable findings in favor of a worktree-status-handoff finding that just names paths/branches and defers classification to /source-control:worktree status. This shrinks the allowed command surface rather than expanding it.
• No new external/untrusted input is introduced — wt_path/wt_branch come from local git worktree list --porcelain output, same trust level as before, and are only ever written into report text via print_field/emit_finding (no eval, no shell re-interpretation, and per security-review.md these fields are %q-encoded so they can't forge report labels or terminal control sequences).
• No .github/workflows files, auth/access-control logic, secrets/token handling, or injection-relevant surfaces are touched in this PR.
• The test diff (audit-fleet.test.sh) explicitly asserts the retired status probe is now rejected by the allowlist, confirming the narrowing is intentional and enforced.

This meets the skill's skip-gate condition ("change has no security-relevant surface after reading the diff"), so no findings to report.

[github-actions]

Last security-reviewed head: f21dbf3b7ff420a3771e16f0d1a1c713adc64fab. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

[claude]

Claude finished @cursor[bot]'s task in 21s —— View job

---

Code review

• Gather context (PR diff, changed files, CLAUDE.md)
• Invoke /review:code-review per custom instructions
• Apply skip gate
• Post result

Skip gate triggered — no review performed.

Per /review:code-review's skip gate: "PR is closed or not open." This PR (#2637) is merged, so there is no open working branch to review or post inline findings against, and the change has already landed on main. Posting a code review now would have no actionable target.

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.