fix(meta): PR #175 review round — all 14 findings addressed

H1 godot-cold-parse exit-code guard (+bonus: import-pass for cold checkouts, found live); H2 pr-watchlist-diff loud registry failure; H3/T1 deny list :* normalization (add-only) + uniform allow syntax; H4/T7 helper-script allows; H5 get_api_key env-only (config.json is tracked — no secret fallback); H6 TEAM.md active/standby split; H7 troblum solo-profiling note; H8 pr-review frontmatter Task->Agent; H9 conventions doc taxonomies fixed vs real tree; T2 ask-gate leash files (settings/hooks) in tracked settings; T3 R-013 cross-reference; T4 governance README index regenerated (pql decisions sync); T5 dudley briefing ACTIVE; T6 pr-process step 7 run-from-main.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.claude/agents/README.md

@@ -107,7 +107,7 @@ Synthesize findings.
 ## Agent usage notes
 
 ### Troblum (Technical Consultant)
-- **Always paired with or supporting Tyre** - never works alone on architecture decisions
+- **Solo** for performance profiling, benchmarking, and technology stress-tests; **paired with Tyre** for architecture second opinions — never the sole voice on an architecture decision
 - Spawned for specific evaluation sidequests, not open-ended discussion
 - Blunt, data-driven, will challenge Tyre's assumptions with evidence
 

.claude/settings.json

@@ -54,8 +54,10 @@
 
       "Bash(godot4:*)",
       "Bash(gdformat:*)",
-      "Bash(tooling/atlas *)",
+      "Bash(tooling/atlas:*)",
       "Bash(tooling/validate-ron:*)",
+      "Bash(tooling/godot-cold-parse:*)",
+      "Bash(tooling/pr-watchlist-diff:*)",
 
       "Bash(chmod *)",
       "Bash(ls *)",
@@ -80,9 +82,32 @@
     ],
     "deny": [
       "Bash(git push --force *)",
+      "Bash(git push --force:*)",
+      "Bash(git push --force)",
       "Bash(git reset --hard *)",
+      "Bash(git reset --hard:*)",
+      "Bash(git reset --hard)",
       "Bash(git clean -f *)",
-      "Bash(rm -rf *)"
+      "Bash(git clean -f:*)",
+      "Bash(git clean -f)",
+      "Bash(rm -rf *)",
+      "Bash(rm -rf:*)"
+    ],
+    "ask": [
+      "Edit(.claude/settings.json)",
+      "Write(.claude/settings.json)",
+      "Edit(.claude/settings.local.json)",
+      "Write(.claude/settings.local.json)",
+      "Edit(.claude/hooks/**)",
+      "Write(.claude/hooks/**)",
+      "Edit(.config/hooks/**)",
+      "Write(.config/hooks/**)",
+      "Edit(.worktrees/**/.claude/settings.json)",
+      "Write(.worktrees/**/.claude/settings.json)",
+      "Edit(.worktrees/**/.claude/hooks/**)",
+      "Write(.worktrees/**/.claude/hooks/**)",
+      "Edit(.worktrees/**/.config/hooks/**)",
+      "Write(.worktrees/**/.config/hooks/**)"
     ]
   },
   "hooks": {

.claude/skills/pr-process/SKILL.md

@@ -285,9 +285,13 @@ git diff --stat main...<branch>
 Draft title (`<type>(<scope>): <summary>`, max 70 chars) and description.
 
 ```bash
-# NB: omit --repo — an explicit slug makes tea skip local-repo setup and
-# pr create dies with "local repository required". Run from the MAIN checkout;
-# tea infers the repo from origin. (.claude/rules/tea-cli.md)
+# NB — both halves matter (.claude/rules/tea-cli.md):
+#  1. omit --repo: an explicit slug makes tea skip local-repo setup and
+#     pr create dies with "local repository required";
+#  2. run THIS ONE COMMAND from the MAIN checkout, not this worktree —
+#     tea's go-git can't read a worktree's .git *file*. From the worktree:
+#     cd "$(git rev-parse --path-format=absolute --git-common-dir)/.."
+#     for this command, then return here for the remaining steps.
 tea pr create \
   --login schweitz \
   --title "<title>" \

.claude/skills/pr-review/SKILL.md

@@ -6,7 +6,7 @@ description: >
   /pr-review. Spawns reviewers matched to the branch type (code, copy, visual,
   audio) in parallel. Reports approve/reject with inline comments.
 user-invocable: true
-allowed-tools: Bash, Read, Grep, Glob, Task, Write
+allowed-tools: Bash, Read, Grep, Glob, Agent, Write
 ---
 
 # PR Review Skill