skills(running-in-ci): catch un-pinned blob/main #L links in the pre-post grep

[tend-agent]

Summary

Extend the existing pre-post github.com/ scan in running-in-ci to also catch un-pinned blob/main/...#L<n> line links, not just wrong-owner typos. PR #240 already strengthened the prose rule from soft preference to hard imperative in April; the rate of recurrence dropped sharply afterwards, but the failure has continued at ~1/month in conversational tend-mention sessions where the model composes URLs inline as it writes prose. The current rule lives in the "Comment Formatting" section but has no enforcement step. The owner-verification check next door already prescribes a pre-post grep for github.com/ — folding the #L-SHA check into that same pass converts the rule from advice into a mechanical pre-flight that the bot is already supposed to run.

Evidence

Recurrences on max-sixty/worktrunk since PR #240 merged 2026-04-11:

When	Where	Un-pinned link
2026-06-05T03:03Z	#2838 comment 4627721929 (this run's window)	blob/main/src/cli/mod.rs#L577
2026-05-07T13:07Z	#2631 comment 4397369106	blob/main/src/commands/worktree/switch.rs#L1045
2026-05-04T10:27Z	#2587 comment 4370290878 (2 in one comment)	blob/main/src/config/user/sections.rs#L240, blob/main/src/cli/mod.rs#L407
2026-05-04T00:26Z	#2564 comment 4367561809	blob/main/src/main.rs#L1300 (also shipped with literal ${GITHUB_REPOSITORY})
2026-04-24T06:59Z	#2397 comment 4311284992	blob/main/src/config/expansion.rs#L368

Cumulative: 5 occurrences across 4 sessions and 5 issues in the 8 weeks since PR #240. All five sessions were tend-mention (discussion-style replies), not tend-triage — the failure mode is concentrated where the model writes prose inline and composes URLs as it goes, rather than where it explicitly stages reference material.

The current-run hit on issue #2838 — a thoughtful 5-paragraph design-discussion reply to max-sixty — links to line 577 of src/cli/mod.rs where the "lifecycle steps 4-5" docstring currently lives. The line is correct as of 7d16e63f but will silently rot the next time the file is edited. No human pushback (maintainer hasn't responded yet); the failure is invisible until the rot happens, which is exactly why this needs a pre-post check rather than only a written rule.

Full evidence log: review-reviewers gist for max-sixty/worktrunk 2026-06.

Gate assessment

Gate	Result	Notes
Confidence (Gate 1)	PASS	High — 5 post-PR-240 occurrences across 4 sessions and 5 issues over 8 weeks. Well above the 2-3 threshold for "consistent pattern across multiple sessions."
Magnitude (Gate 2)	PASS	Targeted fix — one prose sentence extended by ~50 words to fold the #L-SHA check into the existing pre-post github.com/ grep. No new section, no new heading, no structural reshape.
Classification	Structural-adjacent	The rule exists and is correctly framed (PR #240); the gap is enforcement. The owner-verification check has a pre-post grep that the bot runs; the line-link check has only prose. Adding a single pass that handles both is mechanical, deterministic, and lives in the spot the bot is already supposed to visit before posting. Replay test: under inline-prose-composition pressure, the rule alone has measurably missed ~1/month; the grep at the same checkpoint as owner-check turns it into a strict invariant.

PR #240 raised the rule from soft to hard. This PR raises it from hard to enforced, in the same paragraph where the parallel owner-typo check is already enforced.

The change

One paragraph edit in plugins/tend-ci-runner/skills/running-in-ci/SKILL.md. The "GitHub URLs — read $GITHUB_REPOSITORY..." paragraph already prescribed a pre-post scan for owner verification; the edit extends that scan to also cover the #L-SHA invariant and points at $(git rev-parse HEAD) as the substitution target. Net diff: one sentence, two clauses joined into one pre-post pass.

Test plan

• Diff reviews cleanly as a pure guidance rewrite (no behavior changes in generator, workflows, or action).
• Future tend-mention runs that reference specific lines either pre-stage git rev-parse HEAD or run the body grep before posting; the un-pinned blob/main/...#L<n> link shape stops appearing in bot comments.
• review-reviewers evidence count of blob/main/...#L<n> recurrences declines toward zero over the next 4-8 weeks; if a hit appears anyway, this becomes evidence to escalate beyond a pre-post grep (e.g., a hook-enforced check in the action).