…PATCH out of context (#424)

Every status-update-emitting skill (sync, import, allocate,
dedupe, fix) folds its update into one rollup comment per
tracker via the recipe in `tools/github/status-rollup.md`. The
recipe currently walks the agent through: fetch the comment
body, concatenate `<old body>` + ruler + new entry, PATCH the
comment. That loops the full rollup body — which grows
monotonically on long-running trackers — through agent context
on every sync pass.

`tools/github-rollup/` is the same shape as PR #412's
`github-body-field`: a stdlib + `gh` subprocess wrapper that
keeps the body out of agent context. CLI:

  github-rollup append <N> --action "<label>" --entry-body "..."
  github-rollup list   <N>
  github-rollup latest <N>

`append` auto-detects whether the issue already has a rollup
comment (via the marker prefix `<!-- airflow-s status rollup
v`); creates one if not, PATCHes the existing one if yes.
`--now ISO8601`, `--user @handle`, and `--dry-run` flags
support deterministic replay tests and pre-flight checks.

Parser is a small state machine that:

- recognises the rollup marker prefix (forward-compatible with
  future v2+ bumps),
- iterates `<details><summary>YYYY-MM-DD · @user ·
  Action</summary>...</details>` entries in document order,
- preserves entries whose summary doesn't follow the canonical
  shape (returned with blank fields so round-trip stays safe),
- tolerates missing close tags + trailing whitespace.

35 unit tests cover the parser (every edge case from
`status-rollup.md`'s spec — multi-entry, missing marker, non-
canonical summary, missing close tag) and the CLI orchestration
(append-existing, create-new, dry-run create vs append, user
override, all the exit-code contract paths, list, latest).

The migration of the 5+ call sites that currently reference
`tools/github/status-rollup.md` Step 2a will follow in
subsequent PRs once the tool's behaviour is verified in
practice. Adds workspace member + docs/labels-and-capabilities
row in lock-step (caught by `check-workspace-members` prek
hook).

…ity-suite refactor patterns

Adds `optimize-skill` (capability:setup) — the refactoring sibling of
`write-skill`. It takes an existing framework skill (or sweeps a set)
and applies the five restructuring patterns proven on the security
suite, as behavior-preserving proposals gated by the validator
(green-before / green-after):

- split — slim an oversized SKILL.md into linked siblings (the apache#410
  pattern; addresses the PRINCIPLES.md P14 cap)
- config-lift — move concrete values into <project-config> (apache#386/apache#387/apache#388)
- out-of-context — read/PATCH one field without loading the body
  (apache#412 github-body-field, apache#424 github-rollup)
- fetch-upfront — batch per-item round-trips (apache#347)
- preflight-classifier — skip obvious no-ops before LLM passes (apache#414/apache#416)

SKILL.md is 297 lines; the pass catalogue (smell / exemplar PR /
mechanics / behavior-preservation guarantee / validation) lives in
the patterns.md sibling. Reads only framework-internal files, so no
injection-guard / Privacy-LLM callouts.

Ships a step-diagnose eval (5 auto-comparable cases incl. an
injection-resistance case) so the skill is not released without an
eval (P8). Wires the skill into the capability->skill map and the
eval index.

Generated-by: Claude Code (Opus 4.8)

…ity-suite refactor patterns

Adds `optimize-skill` (capability:setup) — the refactoring sibling of
`write-skill`. It takes an existing framework skill (or sweeps a set)
and applies the five restructuring patterns proven on the security
suite, as behavior-preserving proposals gated by the validator
(green-before / green-after):

- split — slim an oversized SKILL.md into linked siblings (the apache#410
  pattern; addresses the PRINCIPLES.md P14 cap)
- config-lift — move concrete values into <project-config> (apache#386/apache#387/apache#388)
- out-of-context — read/PATCH one field without loading the body
  (apache#412 github-body-field, apache#424 github-rollup)
- fetch-upfront — batch per-item round-trips (apache#347)
- preflight-classifier — skip obvious no-ops before LLM passes (apache#414/apache#416)

SKILL.md is 297 lines; the pass catalogue (smell / exemplar PR /
mechanics / behavior-preservation guarantee / validation) lives in
the patterns.md sibling. Reads only framework-internal files, so no
injection-guard / Privacy-LLM callouts.

Ships a step-diagnose eval (5 auto-comparable cases incl. an
injection-resistance case) so the skill is not released without an
eval (P8). Wires the skill into the capability->skill map and the
eval index.

Generated-by: Claude Code (Opus 4.8)

…ity-suite refactor patterns (#427)

Adds `optimize-skill` (capability:setup) — the refactoring sibling of
`write-skill`. It takes an existing framework skill (or sweeps a set)
and applies the five restructuring patterns proven on the security
suite, as behavior-preserving proposals gated by the validator
(green-before / green-after):

- split — slim an oversized SKILL.md into linked siblings (the #410
  pattern; addresses the PRINCIPLES.md P14 cap)
- config-lift — move concrete values into <project-config> (#386/#387/#388)
- out-of-context — read/PATCH one field without loading the body
  (#412 github-body-field, #424 github-rollup)
- fetch-upfront — batch per-item round-trips (#347)
- preflight-classifier — skip obvious no-ops before LLM passes (#414/#416)

SKILL.md is 297 lines; the pass catalogue (smell / exemplar PR /
mechanics / behavior-preservation guarantee / validation) lives in
the patterns.md sibling. Reads only framework-internal files, so no
injection-guard / Privacy-LLM callouts.

Ships a step-diagnose eval (5 auto-comparable cases incl. an
injection-resistance case) so the skill is not released without an
eval (P8). Wires the skill into the capability->skill map and the
eval index.

Generated-by: Claude Code (Opus 4.8)