7 more carried-content defects from a downstream PR review (merge-and-release, python-codestyle, GOVERNANCE.md, WORKFLOW.md)

[ptr727]

Symptom

Copilot and CodeRabbit reviews on the develop -> main promotion PR
ptr727/ESPHome-Config#116 (hub resync,
carrying .github/skills/, GOVERNANCE.md, and WORKFLOW.md from hub commit 3258284, version
2.0.518) raised 7 more findings against hub-owned content this downstream repo cannot fix
locally. Filing per RESYNC.md section 2.

Findings

1. merge-and-release/SKILL.md and drive-pr/SKILL.md: the merge commands don't bind to the
   captured headRefOid. Both skills capture the PR's headRefOid before merging, but their
   gh pr merge invocations don't pass it, so a branch that changed after the Merge Gate check
   can be merged with a different head than the one actually reviewed. gh pr merge --match-head-commit <sha> stops on a mismatch instead.

2. merge-and-release/SKILL.md: no stated behavior for an invalid releaseTrigger. The
   current rule dispatches publish-release.yml for every registry releaseTrigger value except
   none, so a null, empty, or unsupported value still triggers a dispatch instead of stopping.

3. python-codestyle/references/testing.md: the lint-only test-discovery summary omits the
   -s <scripts-dir>/tests scope that profiles.md's own uvx coverage@latest run -m unittest discover -s <scripts-dir>/tests command requires, reading as an unscoped discovery.

4. python-codestyle/SKILL.md: "CI runs the same clean-compile commands" overstates it for
   ruff format. The documented local loop runs the mutating uv run ruff format, but CI (and
   the documented CI command) runs the non-mutating --check form. Worded as written, "the same
   commands" directs a reader to expect CI runs the formatter.

5. python-codestyle/SKILL.md: the lint-only CI contract lists gates the reusable workflow
   doesn't run. Both this repo's callers use validate-task.yml, which runs uvx pyright@latest for a [tool.pyright]-configured subtree, not the documented uvx mypy@latest, and skips the pytest step (no tests/** or uv.lock in a lint-only subtree
   like this repo's easystart/python). The profile documentation and the actual reusable
   workflow have drifted apart.

6. GOVERNANCE.md "Running the Linters Locally": the pre-commit hook's prose checks scope to
   the working tree, not the staged snapshot. A file with valid unstaged content but invalid
   staged content passes the hook (which reads the working tree) while the commit still carries
   the invalid staged version. CI is the eventual backstop, but the hook's whole point is catching
   this before commit.

7. GOVERNANCE.md "Running the Linters Locally": the doc-gate fetch step executes unpinned code
   from a moving branch. hub-fetch-run.py fetches prose_lint.py/repo_gate.py fresh from
   ptr727/ProjectTemplate's main at commit-hook time, with contributor-level execution. A
   compromised hub branch or account becomes code execution on every contributor host that has
   the hook enabled. Pinning to a reviewed commit/digest (with periodic, deliberate bumps) would
   close that window at some convenience cost; worth a deliberate call either way rather than
   silence.

8. WORKFLOW.md D1.6 names the hub's spec/secrets.json typeMechanisms mapping, which the
   carried-doc-references rule's hub-hosted-tool exception doesn't cover (spec/secrets.json is
   data a workflow reads, not a script or snippet a reader runs or copies), so this reads as a
   carried-file reference the rule otherwise bans. Worth a second look regardless of the
   consolidated-checker outcome, since the reference genuinely doesn't fit either exception as
   worded.

Related, not duplicated

• Item 1 overlaps merge-and-release/SKILL.md's branch-cleanup delete step already tracked as
  Decide whether merge-and-release's branch cleanup should use compare-and-delete #946, but is about the merge command itself, not the delete step.
• shell-codestyle/SKILL.md's -E/POSIX-sh finding recurred again on this PR: already tracked
  as 5 carried-skill defects surfaced by a downstream PR review (shell-codestyle, repo-worktree, standup-a-repo, merge-and-release) #1089 (item 1).
• comment-and-doc-style/SKILL.md's "Mount a temporary snapshot, not the live checkout" finding
  (its own doc text still says "the checkout" where OPERATIONS.md requires a snapshot) is the
  same underlying gap as docker_lint.py --root mounts the live checkout, bypassing a repo's secrets-on-disk exclusion #1090, commented there instead of duplicated here.

Evidence

Full finding text, including the scripts CodeRabbit ran to support items 4-5, is in the PR review
at ptr727/ESPHome-Config#116, run stamp 2026-08-29.

[ptr727]

Item 9, same recurring root cause as item 8: GOVERNANCE.md's Repository Details section names registry/repos.json alongside repo-config/configure.sh apply. The configure.sh mention is a legitimate hub-hosted-tool instruction, but the bare registry/repos.json data-file mention next to it isn't covered by either carried-doc-references exception, same as item 8's spec/secrets.json case. Surfaced again on ptr727/ESPHome-Config#116's promotion PR review.