[locus313]

Description

Improves the agent environment based on a retrospective of the enterprise billing report work:

• The block-file-writes-via-bash hook now allows the command when it cannot parse the payload, instead of denying every bash call. It also denies python, node, ruby or perl heredoc scripts that open files for writing.
• Always-loaded instruction files are cut to their repository-specific rules, from about 980 lines to about 70. Changelog guidance that conflicted with Release Please is removed, and the docs instruction now applies to .sh files.
• The make-repo-contribution skill runs the documented checks and reports their results instead of asking the user to run them.
• The testing section in copilot-instructions.md now points to AGENTS.md instead of duplicating it, and the stale "All 18 scripts" count is gone.
• docs/script-behaviors.md documents the billing report's jq constraints: no apostrophes in the single-quoted program, and mlabel because label is a reserved word.
• New tools/screenshot-html.sh renders an HTML report to PNG at screen and print widths for visual checks.

Changes

• New script: <domain>/github-<name>/github-<name>.sh
• Modified: lib/github-common.sh
• Other:
  • .github/hooks/scripts/block-file-writes-via-bash.sh and tests/test_hooks.bats
  • .github/instructions/ (four always-loaded files rewritten)
  • .github/skills/make-repo-contribution/SKILL.md
  • .github/copilot-instructions.md, AGENTS.md, docs/script-behaviors.md
  • tools/screenshot-html.sh

How to test

bats tests/test_hooks.bats
./tools/screenshot-html.sh path/to/report.html

The hook tests cover heredoc, tee and interpreter writes, the object toolArgs form, and an invalid JSON payload. The screenshot tool prints the paths of the screen and print PNGs.

Validation run:

• shellcheck --severity=warning --exclude=SC2034,SC1091 --shell=bash tools/screenshot-html.sh .github/hooks/scripts/block-file-writes-via-bash.sh: passed
• bats tests/: passed (148 tests, 0 failures)
• ./tools/screenshot-html.sh <report.html>: produced both PNGs; no-argument run exits 1 and --help exits 0

Checklist

• set -euo pipefail is the first executable line after the # === header
• Script sources lib/github-common.sh via SCRIPT_DIR (not applicable: no API calls)
• All required env vars validated with require_env_var (not applicable: no env vars)
• Token validated with validate_github_token (or validate_token for secondary tokens) (not applicable)
• User-supplied slugs validated with validate_slug (not applicable)
• sleep added between repo-level operations to respect rate limits (not applicable)
• README.md updated with the new/changed script (env var table + usage example) (not applicable: developer tooling, documented in AGENTS.md)
• Script header comment matches README documentation
• Tested on a non-production org before production (not applicable: no API calls)
• shellcheck passes (shellcheck --severity=warning --exclude=SC2034,SC1091 --shell=bash <script>)