ci: re-pin the code-review skill with bundled criteria

[ss-o]

Summary

Refs z-shell/.github#747. Re-pins the organization code-review skill to the approved revision that bundles the z-shell review criteria (pilot order: documentation repository, after z-shell/zsh-eza#140).

• .github/skills/code-review/: reinstalled with gh skill install z-shell/.github .github/skills/code-review --pin ede9ed9... --dir .github/skills --force. It now carries references/criteria.md. Before --force, the local SKILL.md matched the previously approved digest exactly, so nothing local was overwritten.
• .github/workflows/org-routing.yml: caller moves from 893749c to a07ed57, whose approved record pins ede9ed9 and the criteria blob cb2520c5. The called workflow file is unchanged between the two commits.
• AGENTS.md: routing block regenerated with org-routing.py apply for the new revision.
• .trunk/trunk.yaml: Prettier and markdownlint ignore .github/skills/code-review/**. org-routing.py check compares vendored resource files byte for byte, and Prettier realigns the tables in criteria.md, which the pre-commit formatter would otherwise commit. The exclusion is scoped to the vendored skill so this repository's own skills stay formatted.

Validation

• org-routing.py check --repository z-shell/wiki with z-shell/.github tooling at a07ed57: current, on the committed tree.
• git ls-tree at this head: references/criteria.md is blob cb2520c5, the approved resource id; SKILL.md is byte-identical to the copy merged in ci: re-pin the code-review skill with bundled criteria zsh-eza#140.
• trunk check on the changed files: no issues.

No site content changes; the Docusaurus build is unaffected because .github/ is outside the content roots.

[cloudflare-workers-and-pages]

Deploying zsh with    Cloudflare Pages

Latest commit:	81dc224
Status:	✅  Deploy successful!
Preview URL:	https://25bcc4f4.zsh.pages.dev
Branch Preview URL:	https://feature-747-repin-code-revie.zsh.pages.dev

View logs

[ss-o]

Fallback review under ADR-0026: Copilot request not registered on 81dc224

Findings

No actionable findings on this head.

Scope: complete diff 55b8178...81dc224, one commit, 5 files, reviewed against the organization code-review skill and its bundled criteria at this head. Refs z-shell/.github#747. The base is current main.

Note

Class 1 review under the ADR-0035 sole-maintainer exception. The maintainer declared that no second human reviewer is available and explicitly elected the exception for this pull request at 81dc224. This is a self-review by the agent that wrote the change, not an independent review or approval to merge.

Exception record

• Copilot request: Copilot code review is configured for main (copilot_code_review rule). One request for copilot-pull-request-reviewer[bot] was made at 2026-10-07T03:05:54Z on this head; the response listed no requested reviewer, and the timeline shows no review_requested event and no Copilot review. Request not registered; the maintainer reports that Copilot usage limits are reached.
• Separate read-only review: a separate reviewing session examined this same head without write access and reported no actionable findings. It independently confirmed that references/criteria.md is identical to z-shell/.github at ede9ed9, that SKILL.md differs only in installer metadata, that the approved record at a07ed57 pins ede9ed9 with blob cb2520c5, that org-routing.py check reports the wiki current, that the called workflow is identical at both caller pins, that no other wiki skill is vendored, and that the Trunk exclusion is limited to Prettier and markdownlint on .github/skills/code-review/**. It is additional scrutiny by another session, not a second human.

Validation

• Passed (hosted, this head): all 12 checks, including Org Routing with tooling at a07ed57, Trunk, Validate Corpus, CodeQL and Cloudflare Pages.
• Passed (local, same tree): org-routing.py check --repository z-shell/wiki current; git ls-tree shows references/criteria.md as blob cb2520c5 and SKILL.md byte-identical to the copy merged in z-shell/zsh-eza#140; trunk check on the changed files reports no issues.
• Unavailable: Copilot review (not registered). Runtime discovery of the skill and Copilot attribution remain unverified, as tracked in z-shell/.github#747.

Checklist verdicts and supporting evidence

• Provenance and integrity: pass. Reinstalled with gh skill install at the approved full SHA; installer metadata records ede9ed9. Before --force, the previous local SKILL.md matched the previously approved digest exactly, so no local change was overwritten.
• CI pinning (IMPORTANT criteria): pass. The Org Routing caller stays pinned to a full SHA, and the called workflow file is byte-identical at 893749c and a07ed57; only tooling and approved data change.
• Formatter exclusion: pass, scoped. Prettier and markdownlint skip only the vendored skill; the ten locally authored skills under .github/skills/ stay formatted, and gitleaks still applies.
• Generated content: pass. The AGENTS.md change is only the regenerated routing line.
• Site content: not applicable. No change under docs/, community/, ecosystem/ or src/; the Cloudflare Pages build passes.

Limits and recovery

• This exception does not authorize deployment or a ruleset bypass; merge follows the normal ruleset.
• Recovery: if the re-pin causes a problem, revert the squash commit; the previous skill revision and caller pin are restored by that revert and remain approved-compatible only with the earlier caller pin, which the revert also restores.
• A new head requires a new election and both reviews.