chore(agents): add "Git workflow (every task)" rule to all agents + skills

Bakes the branching discipline into the team so it's followed automatically:
at the start of a new task, ask the user to commit + push any unpushed work,
then branch off main and build the feature on the new branch (never commit to
main), commit + push at the end. Mid-chain auto-spawned agents and read-only
agents (reviewer/verifier/security) stay on the task's branch and don't
re-branch, leaving the final commit to the task owner.

Appended one identical "## Git workflow (every task)" section to all 11
.claude/agents/*.md and all 11 .claude/skills/*/SKILL.md (22 files). Docs/
tooling only (.claude/ is not in the built app) — no version bump / CHANGELOG.

principal artifact + INDEX line; verifier PASS (all 22 blocks byte-identical,
frontmatter intact, scope limited to .claude + audit files, mid-chain clause
behaviorally sound).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VEsaHQx8cXr1hFrKU42UK6

claude_artifacts/principal-20260829-122943.md

@@ -0,0 +1,31 @@
+# principal — team-wide "Git workflow (every task)" rule
+
+**Date:** 2026-08-29 · branch `chore/agent-git-workflow` · docs/tooling only (no app version bump)
+
+## Change
+User asked to bake the git discipline into the team so it's followed automatically:
+*"every new task → ask to commit and push not-pushed code → branch from master → build the
+feature on the new branch."* User chose scope: **all 11 agents + all 11 skills** (22 files).
+
+Appended one identical `## Git workflow (every task)` section to the end of every
+`.claude/agents/*.md` and `.claude/skills/*/SKILL.md`. The rule:
+- At the **start of a new task**, if the tree has uncommitted/unpushed work, **ask the user
+  to commit and push it first**.
+- Then **branch off `main`** (`git checkout -b feature/<slug>`), build the feature there,
+  **never commit directly to `main`**, commit at the end, `git push -u origin <branch>`.
+- **Mid-chain auto-spawned** agents and **read-only** agents (reviewer/verifier/security)
+  **stay on the task's branch — don't re-branch**, and leave the final commit to the task owner.
+  (This clause prevents the engineer→reviewer→verifier chain from each re-branching.)
+
+## Not shipped code
+`.claude/` is developer tooling, not part of the built app (the Docker build copies `server/`
++ `client/`), so **no version bump / CHANGELOG / build** — an artifact + INDEX line + the
+verifier gate are the appropriate audit trail here.
+
+## Verified
+- `grep -c "## Git workflow (every task)"` across the 22 targets → exactly 1 each (22 total).
+- Spot-checked a read-only agent (`verifier.md`) and a writer skill (`engineer/SKILL.md`):
+  clean append, frontmatter intact, wording fits both roles.
+- verifier: (see verifier-log entry for 2026-08-29).
+
+## Next: done.