Prepare v0.3.0: permission patterns, disclosure, tool pins, notifications

Andrew Dunnrequested to merge
v030-prep into main

Five fixes for v0.3.0, one commit each. No version bump and no tag; the release MR does that.

  1. Permission patterns from any directory. allowed-tools held Bash(just lab *) and Bash(just contrib *), which match only from the skill folder. They now name just -f ${CLAUDE_SKILL_DIR}/justfile lab * (and contrib), and SKILL.md tells the model to run that exact form, unquoted. A quoted path does not match. Proof: in a temp project with the skill linked into .claude/skills, claude -p asking for the lab recipe menu (--setting-sources project, default permission mode) was denied before (permission_denials held the just Bash calls) and is empty after.
  2. AI disclosure. Public-sector MRs carry the AI-Assisted: yes trailer only, no AI paragraph. public-writes.md now says so and keeps the paragraph for gitlab-org/gitlab, whose own guidance asks for disclosure with no trailer. The commit body cites what was read from master at d9d0e667. No script, template or test inserted the paragraph.
  3. skillspector pin. A root mise.toml pins skillspector v2.2.3 (the version the manifest records), python and uv, and a venv with PyYAML 6.0.3 through a postinstall hook. mise exec -- just vendor-sync c5272c9b... exits 0, accepts 28 of 28 findings, and leaves no diff. Before, the global v2.11.1 failed closed on 9.
  4. VM-up notification. cmd_up runs herdr notification show the moment the machine exists (title <SIM_OWNER or instance>: VM up, body instance, base, machine type, down-by time). It skips silently without herdr and never fails up. tests/run.sh asserts it with a stub herdr on PATH, and the engine self-test stubs herdr so a run raises no real notification. No VM was provisioned.
  5. Suggestion batch through upstream-post. publish calls upstream-post suggestion-apply when it is on PATH and falls back to raw glab only without it. The suggestions draft now records the project and MR iid (and a commit message when given), and refuses to draft without them. Tests assert the arguments, the fallback and the refusal. Nothing was posted.

Fix 5 changes the posting path; the others do not (fix 1 changes how the command is typed, not where it goes).

flowchart LR
  C["just contrib apply-suggestions<br/>--project P --iid N"] --> D["draft: ids, project, iid"]
  D --> A{"approved?"}
  A -- yes --> P["just publish draft"]
  P -- "upstream-post on PATH" --> U["upstream-post suggestion-apply<br/>checks ids, lints message"]
  P -- "otherwise" --> G["ids-batch-apply.sh: raw glab"]
  U --> F[("forge")]
  G --> F

just ci and just sims-check pass. The SKILL.md description is unchanged.

Merge request reports