Ralph mode: approval gates before push, PR and merge actions #2465

Problem

Ralph mode (the coordinator's backlog work-monitor loop) scans GitHub, then creates branches, pushes, opens PRs and merges approved PRs. It's told not to stop and ask permission between items. Code scanning flagged this as an excessive-agency risk on the Claude Code plugin's copy of the text in #2463 (thread).

The behaviour isn't new in #2463. The same text is in:

• the coordinator prompt: .squad-templates/squad.agent.md, item 9, and its mirrors
• the Claude coordinator projection: packages/squad-sdk/src/client/adapters/coordinator.ts (since feat(clients): add --client host adapters for Claude, Kiro, OpenCode, Cursor, Codex, and Antigravity [1/4] #2251 and feat(claude): Claude projection v2: member subagents, skills, governance hooks, watch preset #2450)
• ralph-charter.md and ralph-reference.md

The plugin copies it as is. Changing Ralph's semantics is a product decision for all hosts, so it's tracked here rather than in the plugin PR.

Proposal

• Keep reading autonomous: scanning, triage, routing, reporting and rescanning.
• Put a deterministic gate in front of state-changing GitHub actions: push, PR create or edit, merge, close or reopen, label changes and workflow reruns. Options:
  • Per item: the coordinator shows the planned write and waits for approval.
  • Scoped pre-approval: the user grants it when starting Ralph (for example "Ralph, go — may open PRs, never merge"), and the coordinator records and honours it.
  • Host permissions: on Claude Code, rely on the permission system (no allowed-tools grants for git push or gh pr merge), and say so in the prompt.
• Keep the existing reviewer, circuit-breaker and auth checks.
• Apply the change in the canonical template, the Claude projection and the plugin. Then regenerate the mirrors and run node scripts/build-claude-plugin.mjs.

Done when

• The Ralph text on every host names the approval gate.
• A test asserts that the gate's wording appears in each projection.
• The docs (concepts/github-workflow.md, the watch-monitor blog post where relevant) describe the gate.

Related: #2438, #2443, #2463.