docs: enable markdownlint MD040 and tag all fenced code blocks (supersedes #30)

.claude/skills/pr-management-code-review/prerequisites.md

@@ -25,7 +25,7 @@ the target repo (`<upstream>` by default). Without
 collaborator access, the eventual `gh pr review` mutation in
 [`posting.md`](posting.md) returns:
 
-```
+```text
 HTTP 403: Resource not accessible by integration
 ```
 

.claude/skills/pr-management-code-review/review-flow.md

@@ -28,7 +28,7 @@ multi-line headline. Per Golden rule 10 in `SKILL.md`, the PR
 number is always printed alongside its full URL so the
 maintainer can click straight through:
 
-```
+```text
 PR #65934 — Fix scheduler N+1 on serialized Dag load
   https://github.com/<upstream>/pull/65934
   Author: alice (CONTRIBUTOR, [external])

.claude/skills/pr-management-stats/classify.md

@@ -91,7 +91,7 @@ Mark which path the skill used in the legend output (`drafted by triager (heuris
 
 The age of a PR for bucketing is the time since the author's *last interaction*:
 
-```
+```text
 last_author_interaction = max(
     most_recent_comment.createdAt where comment.author.login == pr.author.login,
     last_commit.committedDate,
@@ -120,7 +120,7 @@ Four buckets is the deliberate minimum — each one maps to a distinct maintaine
 
 A PR is by a *contributor* (for the `Contrib.` column) when:
 
-```
+```text
 authorAssociation NOT IN (OWNER, MEMBER, COLLABORATOR)
 ```
 
@@ -138,7 +138,7 @@ The `Ready` column counts PRs carrying the `ready for maintainer review` label.
 
 Table 1's `Responded` column measures, per area, how many triaged PRs got an author reply *before* they were closed or merged. For a PR in the closed-since set:
 
-```
+```text
 responded_before_close =
     is_triaged AND
     exists(comment by pr.author where comment.createdAt > triage_comment.createdAt AND comment.createdAt <= pr.closedAt)

.claude/skills/pr-management-stats/fetch.md

@@ -55,7 +55,7 @@ query(
 
 ### `searchQuery`
 
-```
+```text
 is:pr is:open repo:<repo> sort:created-asc
 ```
 
@@ -199,15 +199,15 @@ Empirical delta on `<upstream>`, cutoff 2026-03-11:
 
 When the maintainer explicitly asks for a quick approximation (`fast-closed` flag, or in a low-budget context), fall back to the search-based path:
 
-```
+```text
 is:pr -is:open repo:<repo> closed:>=<cutoff> sort:updated-desc
 ```
 
 The fast path must print a clear caveat above Table 1: *"fast-closed mode: Table 1 uses the free-text search index which currently undercounts older triaged+merged PRs on `<upstream>`. Re-run without `fast-closed` for accurate numbers."*
 
 ### `searchQuery`
 
-```
+```text
 is:pr -is:open repo:<repo> closed:>=<cutoff> sort:updated-desc
 ```
 

.claude/skills/pr-management-stats/render.md

@@ -121,7 +121,7 @@ Counts must sum to the open-PR total (non-bot). If they don't, print a warning a
 
 Before the first table, print one line summarising the scope. This line is plain text (no Rich markup needed — it's header-style, not a table) so it renders identically in the terminal and in the Markdown fallback.
 
-```
+```text
 <upstream> — 413 open PRs (non-bot) · closed/merged since 2026-03-11 · viewer @potiuk · 2026-04-22 22:33 UTC
 ```
 
@@ -131,7 +131,7 @@ The `<now>` is the fetch-start timestamp, not the render-end timestamp — a slo
 
 If the closed-since counts came from the lagging search index (see [`fetch.md#known-limitation`](fetch.md)), print a one-line caveat between the context line and Table 1:
 
-```
+```text
 ⚠ Table 1 built from GitHub's free-text search of the quality-criteria marker. The index lags — older triaged+merged PRs are likely undercounted. Pass accurate-closed for the hybrid REST + GraphQL path.
 ```
 
@@ -229,7 +229,7 @@ console.print(Panel("\n".join(legend_lines), border_style="dim", expand=False))
 
 Close with a single-line summary the maintainer can use for at-a-glance reporting:
 
-```
+```text
 Summary: 413 open · 66 triaged (16%) · 3 responded (5% of triaged) · 126 ready for review · 43 drafted by triager in last 7d.
 ```
 

.claude/skills/pr-management-triage/comment-templates.md

@@ -26,7 +26,7 @@ Placeholders:
 All templates use the canonical link to the quality-criteria
 document:
 
-```
+```markdown
 [Pull Request quality criteria](https://github.com/<upstream>/blob/main/contributing-docs/05_pull_requests.rst#pull-request-quality-criteria)
 ```
 
@@ -421,7 +421,7 @@ bad-faith actor a footnote to argue with.
 one bullet per violation returned by the classifier. Each
 bullet has the form:
 
-```
+```markdown
 - :x: **<category>** — <explanation>. See [docs](<doc_link>).
 ```
 

.claude/skills/pr-management-triage/fetch-and-batch.md

@@ -119,7 +119,7 @@ query(
 below. The typical production shape for the default sweep on
 `<upstream>` is:
 
-```
+```text
 is:pr is:open repo:<upstream>
 -label:"ready for maintainer review"
 sort:updated-asc

.claude/skills/pr-management-triage/interaction-loop.md

@@ -74,7 +74,7 @@ For each group, present one screen of information. The goal is
 a decision in under 15 seconds when the suggestion looks right,
 or a natural path to per-PR inspection when it doesn't.
 
-```
+```text
 ─────────────────────────────────────────────────────
 Group 3 of 8  —  deterministic_flag → draft  —  5 PRs
 
@@ -155,7 +155,7 @@ step in place of `[A]`/`[E]`.
 When a PR is pulled out of a group (via `[P]`, `[E]`, or
 because its group mandates per-PR), present the full detail:
 
-```
+```text
 ─────────────────────────────────────────────────────
 PR #65471   "Add support for new db dialect"
 Author: @eve  (tier: new, 2 merged / 5 total on this repo)
@@ -307,7 +307,7 @@ the drill-in, it's instant.
 When `[A]` triggers batched mutations, show live progress as a
 short table that updates in-place:
 
-```
+```text
 Applying action: draft  (5 PRs, parallelism: 5)
 
   #65401 @alice — posting comment… done
@@ -330,7 +330,7 @@ before moving on.
 On exit (either `[Q]` or after the last group), print a
 session summary:
 
-```
+```text
 Session summary — 2026-04-22 09:42 UTC → 10:07 UTC (25m)
 
 PRs presented:  47

.claude/skills/pr-management-triage/workflow-approval.md

@@ -160,7 +160,7 @@ For each PR in the group, in the order returned by the
 classifier (which is age-ascending so the freshest PRs land
 first), print:
 
-```
+```text
 ─────────────────────────────────────────────────────
 [N] PR #NNNNN  "<title>"
 Author: @<login>  (account: D days old, R repos, M merged PRs)
@@ -192,7 +192,7 @@ patterns matched"*. That's the green-light pre-classification.
 After all blocks are printed, render the summary table and
 prompt for selection:
 
-```
+```text
 ─────────────────────────────────────────────────────
 pending_workflow_approval — N PRs · choose what to approve
 ─────────────────────────────────────────────────────

.claude/skills/security-cve-allocate/SKILL.md

@@ -305,14 +305,14 @@ over-stripping is worse than leaving one redundant word in.
 Compose a proposal block that carries everything the user needs in
 one copy-paste pass:
 
-```markdown
+````markdown
 **Allocate a CVE for [<tracker>#<N>](https://github.com/<tracker>/issues/<N>).**
 
 1. Open the ASF Vulnogram allocation form:
    <https://cveprocess.apache.org/allocatecve>
 2. In the *Title* field, paste this:
 
-   ```
+   ```text
    <stripped title>
    ```
 
@@ -326,7 +326,7 @@ one copy-paste pass:
 4. Click *Allocate*. Vulnogram returns a `CVE-YYYY-NNNNN` ID.
 5. Paste the allocated CVE ID back into this conversation — the
    skill will pick it up and update the tracker automatically.
-```
+````
 
 Scope → Vulnogram product table: the adopting project's scope labels
 and their CVE product / package-name mappings are defined in

.claude/skills/security-issue-fix/SKILL.md

@@ -462,7 +462,7 @@ Write out the exact `--body` the skill will pass to
 - the standard Gen-AI disclosure block per
   [`<upstream>/contributing-docs/05_pull_requests.rst`](https://github.com/<upstream>/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions):
 
-  ```
+  ```markdown
   ##### Was generative AI tooling used to co-author this PR?
 
   - [X] Yes — Claude Opus 4.6 (1M context)

.claude/skills/security-issue-import-from-md/SKILL.md

@@ -286,7 +286,7 @@ The tracker title is the finding's `# Title` with the standard
 convention; see
 [`tools/github/issue-template.md`](../../../tools/github/issue-template.md)):
 
-```
+```text
 [ Security Report ] <finding title>
 ```
 
@@ -377,7 +377,7 @@ exactly one blank line before `</details>`.
 
 Render a single proposal covering every parsed finding:
 
-```
+```text
 <file-basename> — N findings parsed.
 
 | # | Severity | Category                       | Title                                              | Possible duplicate |
@@ -581,7 +581,7 @@ purpose for this finding and would otherwise accumulate.
 After every finding lands, print a short one-liner so the user can
 see progress on long batches:
 
-```
+```text
 [K/N] <tracker>#NNN — <finding title>
 ```
 
@@ -661,7 +661,7 @@ the validity discussion produces signal.
 
 ### Example 1 — A six-finding AI-scan output
 
-```
+```text
 import findings from /tmp/scan-michaelwinser-airflow-2026-04-28.md
 ```
 
@@ -675,7 +675,7 @@ reference.
 
 ### Example 2 — A single-finding scanner export
 
-```
+```text
 import findings from ~/Downloads/sast-export.md
 ```
 
@@ -686,7 +686,7 @@ as a Gmail import; the only difference is the source format.
 
 ### Example 3 — Malformed input
 
-```
+```text
 import findings from /tmp/notes.md
 ```
 

.claude/skills/security-issue-import-from-pr/SKILL.md

@@ -710,7 +710,7 @@ with other trackers.
 
 ### Example 1 — `providers` scope, already merged
 
-```
+```text
 import from pr 65703
 ```
 
@@ -729,7 +729,7 @@ disclosure; see *[Reporter credit policy](#reporter-credit-policy-for-public-pr-
 
 ### Example 2 — `airflow` scope, in-flight
 
-```
+```text
 import from pr https://github.com/<upstream>/pull/65999
 ```
 
@@ -742,7 +742,7 @@ proposes everything; on user confirmation, the tracker lands
 
 ### Example 3 — Mixed-scope PR (blocker)
 
-```
+```text
 import from pr 66042
 ```
 

.claude/skills/security-issue-import/SKILL.md

@@ -250,7 +250,7 @@ When PonyMail MCP is enabled and authenticated (Step 0) **and**
 `tools.ponymail.private_lists`, run the archive as a **paired
 authoritative check** against the Gmail result set:
 
-```
+```text
 mcp__ponymail__search_list(
   list: "security",
   domain: "<project>.apache.org",
@@ -481,7 +481,7 @@ fuzzy-match search against existing issues on three orthogonal keys:
 For every candidate, surface the match results under a *Potential
 duplicates* sub-item in the Step 5 proposal — format:
 
-```
+```markdown
 - thread <threadId> — "<candidate title>"
   - GHSA match: [#NNN](...) "GHSA-xxxx-yyyy-zzzz"  (STRONG)
   - Code-pointer match: [#MMM](...) "BaseSerialization.deserialize"  (MEDIUM)
@@ -553,7 +553,7 @@ authenticated (Step 0) **and** `security@<project>.apache.org`
 is in `config/user.md` → `tools.ponymail.private_lists`,
 **PonyMail MCP is the primary backend for this step**:
 
-```
+```text
 mcp__ponymail__search_list(
   list: "security",
   domain: "<project>.apache.org",

.claude/skills/security-issue-invalidate/SKILL.md

@@ -658,7 +658,7 @@ Hand-off line:
 
 ### Example 1 — `security@`-imported, dag-author-input class
 
-```
+```text
 invalidate 244
 ```
 
@@ -676,7 +676,7 @@ verbatim quotes and the draft ID. Hand-off: terminal.
 
 ### Example 2 — PR-imported, no email
 
-```
+```text
 invalidate 355
 ```
 
@@ -694,7 +694,7 @@ import-from-pr skill's golden rules.
 
 ### Example 3 — Hard stop: CVE already allocated
 
-```
+```text
 invalidate 257
 ```