fix(pstack): apply shared Bugbot triage in Babysit

[ericlitman]

Closes #20

Why

The standalone Babysit skill did not use the fix/dismiss/ask policy already required by poteto-mode Babysit. The same review-bot comment could therefore receive different treatment depending on which entry point handled it.

What changed

• Scope the existing general review-comment rule to human reviewers.
• Require Bugbot and similar automation to use the canonical fix/dismiss/ask rubric, including its ask-by-default categories.
• Keep one rubric at poteto-mode/references/bugbot-triage.md and link to it from both Babysit entry points.
• Add one packaged-tree invariant for the canonical file, both operational bindings, the standalone Markdown destination, required classification/escalation text, and the one-copy rule.

Tradeoffs

The check intentionally inspects the two operational lines instead of accepting the path anywhere in either file. It does not copy or edit the rubric, merge the entry points, or add a new test helper.

Blast radius

The behavior change is limited to review-bot triage in the independently authored standalone Babysit skill. The poteto-mode playbook and canonical rubric remain byte-for-byte unchanged. Open Pstack stays at 1.1.0 pending the consolidated minor release.

Verification

• Bun tests, strict typecheck, static invariants, and plugin validation pass.
• The exact candidate is installed in every affected harness.
• The changed behavior passes from each real user surface.
• The installed version, action, and observed result appear below.

Local verification:

• bun run test: 101 passed, 0 failed, 451 assertions across 10 files.
• bun run typecheck: passed.
• Manifest parsing and PSTACK_STATIC_ONLY=1 bash tests/skill-collision-repro.sh: passed.
• The canonical rubric hash remains unchanged.
• A safe temporary package copy failed for a missing canonical file, a decoy Markdown destination, a removed standalone operational line, a removed poteto-mode step-8 binding with the step-9 path intact, and an extra rubric copy. The unmodified copy passed.
• The four-model Interrogate review found the original invariant accepted decoy paths and the human-review rule could preempt bot triage. Both findings are fixed in the current head.

Live evidence:

• Candidate head: 4bf252ca7011d09db519a42524ce3e0a1f17fec7.
• Claude Code loaded pstack@open-pstack 1.1.0 from its installed cache, resolved the standalone relative link to the canonical rubric, found both Babysit bindings and exactly one rubric, then classified the four probes as fix/dismiss/ask/ask.
• Codex loaded pstack@open-pstack 1.1.0 from its installed cache, resolved the same relative link, found both bindings and exactly one rubric, then classified the probes as fix/ask/ask/ask.
• Both surfaces applied the shared policy. Their difference on the deliberately adversarial Markdown-only SQL-injection probe exposes an existing overlap between dismiss with concrete disproof and the rubric's security ask default. This PR leaves the canonical rubric unchanged as scoped; both surfaces escalated the unambiguous auth, permission-boundary, and migration probe.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request