ci: re-pin the code-review skill with bundled criteria

[ss-o]

Summary

Refs z-shell/.github#747. Re-pins the organization code-review skill to the approved revision that bundles the z-shell review criteria, following the pilots in z-shell/zsh-eza#140 and z-shell/wiki#939.

• .github/skills/code-review/: reinstalled with gh skill install z-shell/.github .github/skills/code-review --pin ede9ed9... --dir .github/skills --force. It now carries references/criteria.md. Before --force, the local SKILL.md matched the previously approved digest exactly, so nothing local was overwritten.
• .github/workflows/org-routing.yml: caller moves from 893749c to a07ed57, whose approved record pins ede9ed9 and the criteria blob cb2520c5. The called workflow file is unchanged between the two commits.
• AGENTS.md: routing block regenerated with org-routing.py apply for the new revision.
• .trunk/trunk.yaml: Prettier and markdownlint ignore .github/skills/code-review/**. org-routing.py check compares vendored resource files byte for byte, and Prettier realigns the tables in criteria.md.

Validation

• org-routing.py check --repository z-shell/src with z-shell/.github tooling at a07ed57: current, on the committed tree.
• git rev-parse HEAD:.github/skills/code-review/references/criteria.md is cb2520c5, the approved resource id; SKILL.md is byte-identical to the copies merged in ci: re-pin the code-review skill with bundled criteria zsh-eza#140 and ci: re-pin the code-review skill with bundled criteria wiki#939.
• trunk check on the changed files: no issues.

[cloudflare-workers-and-pages]

Deploying src with    Cloudflare Pages

Latest commit:	87a032f
Status:	✅  Deploy successful!
Preview URL:	https://5c3a408c.zi-src.pages.dev
Branch Preview URL:	https://feature-747-repin-code-revie.zi-src.pages.dev

View logs

[ss-o]

Fallback review under ADR-0026: Copilot request not registered on 87a032f

Findings

No actionable findings on this head.

Scope: complete diff 0bfdc6e...87a032f, one commit, 5 files, reviewed against the organization code-review skill and its bundled criteria at this head. Refs z-shell/.github#747. Base main.

Note

Class 1 review under the ADR-0035 sole-maintainer exception. The maintainer declared that no second human reviewer is available and explicitly elected the exception for this pull request at 87a032f. This is a self-review by the agent that wrote the change, not an independent review or approval to merge.

Exception record

• Copilot request: Copilot code review is configured for main (copilot_code_review rule). One request for copilot-pull-request-reviewer[bot] was made at 2026-10-07T04:12:22Z on this head; the response listed no requested reviewer, and the timeline shows no review_requested event and no Copilot review. Request not registered; the maintainer reports that Copilot usage limits are reached.
• Separate read-only review: a separate reviewing session examined this same head without write access and reported no actionable findings. It independently confirmed that references/criteria.md is identical to z-shell/.github at ede9ed9, that SKILL.md differs only in installer metadata, that the approved record at a07ed57 pins ede9ed9 with blob cb2520c5, that the second vendored skill zi-install stays current at its approved revision, that org-routing.py check reports z-shell/src current, that the called workflow is identical at both caller pins, and that the Trunk exclusion is limited to Prettier and markdownlint on .github/skills/code-review/**. It is additional scrutiny by another session, not a second human.

Validation

• Passed (hosted, this head): 15 checks (1 skipped by their own conditions). Org Routing resolved its tooling at workflow_sha a07ed57 and reported org routing for z-shell/src is current, which covers the skill pin, the SKILL.md digest, the references/criteria.md blob and the generated AGENTS.md block.
• Verified at this head: exactly the five expected files change; SKILL.md is blob 200faa4f and references/criteria.md is blob cb2520c5, byte-identical to the merged pilots; the AGENTS.md and workflow changes are one line each; the Trunk change adds only the exclusion entry. Locally before commit: org-routing.py check current and trunk check clean on the changed files.
• Unavailable: no Copilot review (request not registered). Runtime discovery of the skill and Copilot attribution remain unverified, as tracked in z-shell/.github#747.

Checklist verdicts and supporting evidence

• Provenance and integrity: pass. Reinstalled with gh skill install at the approved full SHA ede9ed9. Before --force, the previous local SKILL.md matched the previously approved digest exactly, so no local change was overwritten.
• CI pinning (IMPORTANT criteria): pass. The Org Routing caller moves from 893749c to a07ed57, still a full SHA; the called workflow file is byte-identical at both commits, so only tooling and approved data change.
• Formatter exclusion: pass, scoped. Prettier and markdownlint skip only .github/skills/code-review/**, added to a new ignore list; other linters and any local skills are unaffected.
• Generated content: pass. The AGENTS.md change is only the regenerated routing line naming the new approved revision.
• Source code: not applicable. No source, test or documentation content changes.

Limits and recovery

• This exception does not authorize deployment or a ruleset bypass; merge follows the normal ruleset.
• Recovery: reverting the squash commit restores the previous skill revision and caller pin together, which remain consistent with each other.
• A new head requires a new election and both reviews.