docs(docs-hygiene): process derivability route-to-sibling batch (0.14.7)

[kyle-sexton]

Closes #2735

Summary

Replacement for #2798 (squash-merged into the wrong stack base when that branch was not main). Re-lands 0.14.7 on top of #2795.

Related

• Docs-hygiene stack after docs(docs-hygiene): share clean-tree fallback across audit skills (0.14.6) #2795; precedes compress remediations (0.15.0 / former fix(docs-hygiene): compress caveman/taxonomy audit remediations (0.15.0) #2805).
• Supersedes docs(docs-hygiene): process derivability route-to-sibling batch (0.14.7) #2798's misplaced merge.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude finished @kyle-sexton's task in 35s —— View job

---

Security Review

• Gather context (PR diff, changed files)
• Apply skip gate check
• Review changed files for security-relevant surface
• Post final findings

Skip gate applied — no review performed. This PR touches only documentation and metadata:

• docs/conventions/commit-convention/README.md — prose edit relocating a design-topic reference into a new ## Sources section
• plugins/docs-hygiene/.claude-plugin/plugin.json — version bump 0.14.6 → 0.14.7
• plugins/docs-hygiene/CHANGELOG.md — changelog entry for the release
• plugins/docs-hygiene/context/derivability-route-followups.md — new in-tree status board (markdown table/prose) tracking a prior audit-derivability sweep
• plugins/docs-hygiene/skills/audit-derivability/SKILL.md — one-line doc addition linking to the new follow-ups file

No code, scripts, GitHub Actions workflows, permissions, or configuration with runtime effect are touched. There is no injection surface, no auth/access-control logic, no secret/token handling, and no trust-boundary change. Per the skip gate, "no security-relevant surface after reading the diff" — no findings to report.

[github-actions]

Last security-reviewed head: 43776aee85c8ae5b5ae098db3f71ae2c38622052. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

[kyle-sexton]

Superseded by #2812 (re-landed on main after #2795). No new issue.

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[github-actions]

Warning

Automated review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

• Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/31918618942
• Failure class: other
• Last SDK result: (no execution file was produced)

Re-run the job, or workflow_dispatch this workflow with the PR number, to retry the review. A new push re-triggers this lane only if the caller's pull_request triggers include synchronize (the canonical caller omits it).
An automatic retry may already have run — it is skipped when a partial review could duplicate comments, or when the failure class needs an operator (auth).