Promote five inbox lessons into .claude (Part of #5286)

.claude/agents/gitgalaxy-pr-worker.md

@@ -72,7 +72,7 @@ Main holds no rendered evidence report (#5206): read levels with `python tests/t
 - Before calling any failure "pre-existing": `git fetch` and re-test on current origin/main (`pr_gates.py --vs-main` does it).
 - `pr_gates --fast` uses the CI ruff 0.16.10 from `~/.cache/gitgalaxy/ruff-0.16.10`; the shared venv's 0.16.0 `ruff format` rewrites ~20 unrelated files, so format only your own files with the CI ruff (#5189).
 - `ruff format` changed `.py` files only (`git diff --name-only`, never bare `ruff format .`), THEN regenerate any baseline.
-- Gates before push: `pr_gates.py --fast` and `--ratchets` ONLY, via `heavy-run.sh`, with JDK 17 from `equivalence_env --shell`; never two gate runs at once. The full suite is CI's job (owner, 2026-10-07). It warns if local ruff/mypy/python differ from CI; follow its private-venv hint. Re-read new subclasses for a missing `super().__init__()`. The `port-surface` ratchet can fail in a full `--ratchets` run and pass alone: rerun it with `--only-ratchets port-surface --vs-main` before chasing it (#5167). Lint with `pr_gates --fast`, not bare `ruff check` (#5177).
+- Gates before push: `pr_gates.py --fast` and `--ratchets` ONLY, via `heavy-run.sh`, with JDK 17 from `equivalence_env --shell`; never two gate runs at once. The full suite is CI's job (owner, 2026-10-07). It warns if local ruff/mypy/python differ from CI; follow its private-venv hint. Re-read new subclasses for a missing `super().__init__()`. The `port-surface` ratchet can fail in a full `--ratchets` run and pass alone: rerun it with `--only-ratchets port-surface --vs-main` before chasing it (#5167). Lint with `pr_gates --fast`, not bare `ruff check` (#5177). Running the cached ruff binary directly also ignores the repo's per-file rules (#5287).
 - Taking over a stale or foreign branch: check divergence first (`git rev-list --left-right --count origin/main...HEAD`). A red caused by staleness (pins, golden masters) is fixed by the merge rule in the next bullet, not by merging just to be current.
 - Merge main ONLY for a reason (#5134, owner 2026-10-14): the PR is CONFLICTING/dirty, a required check fails because of main, or golden masters / generated files must be re-blessed after a sibling merge. Never merge main just to be current or "behind": every push to a ready PR costs a full CI run (27% of CI minutes were superseded-SHA runs), and the shepherd no longer updates a behind branch. How: `git merge origin/main`, never rebase, never force-push. Generated files: take main's, then regenerate with their tools; check baselines git may silently revert (ruff baseline: regenerate, don't hand-merge).
 - Commit only your own files (explicit `git add <file>`; never `-A`; `docs/self_scan/gitgalaxy_master.db-shm` / `-wal` show up untracked in plan-first worktrees: never add them, #5103); check `git diff origin/main --stat` has nothing unrelated. Commit messages and the PR body end with the attribution lines the launching session gave you, verbatim.

.claude/rules/python-test-traps.md

@@ -23,3 +23,5 @@ globs: "gitgalaxy/**/*.py,tests/**/*.py"
   socket guards on a Windows leg (#5253).
 * **CI helper scripts the workflows call before the project is installed** (e.g. `tests/tools/db2_image_cache.py`)
   must stay stdlib-only (#5265).
+* **A trailing `# comment` on a `.gitignore` pattern line becomes part of the pattern** (`git check-ignore` fails and
+  `test_no_page_is_committed_and_each_is_ignored` goes red): put comments on their own line (#5287).

.claude/skills/cics-command-slice/SKILL.md

@@ -137,6 +137,9 @@ Traps `--check` exists for:
 3. **Phase A** (gitgalaxy, ledger only): with the crucible checked out at the UNTAGGED commit and
    `CICS_CRUCIBLE_ALLOW_UNPINNED=1`, run `cics_crucible.py --update-baseline` and review every moved cell (new cells
    only for new cases; a newly failing cell on an unchanged case is a gitgalaxy regression). Do not move the pin.
+   `--update-baseline` refuses `--cases`: it needs the full run (can pass the 10-min foreground limit, so background
+   it) and rewrites `coverage.json` and `docs/language_status/cics_crucible.md` too; commit all three (#5285). On a
+   `cics_crucible.md` merge conflict take main's copy and regenerate it with `cics_crucible.py`, never hand-merge.
 4. **Tag** (crucible): only after the owner approves -- `git tag -a vX.Y.Z <commit>`, push, `gh release create`.
 5. **Phase B** (gitgalaxy, one PR): `PINNED_REF`, baseline / coverage, re-prove the committed ports
    (`crucible_port_provenance.py reprove`), evidence (`evidence.py prove`; no rendered report), then