[bug] /idd-all PR template contains literal 'Closes #N' that triggers GitHub auto-close — defeats IDD close-gate discipline

[kiki830621]

Problem

The PR body template emitted by `/idd-all` Phase 5 contains a warning that itself triggers the behavior it warns against. The warning text contains the literal string `Closes #N` (where `N` is the issue number), which GitHub's auto-close regex matches regardless of surrounding context — including inside negation language and inline code fences.

Current template (in `idd-all/SKILL.md` Phase 5, PR mode branch):

```
🤖 Generated by /idd-all. Do NOT add 'Closes #${N}' — IDD discipline requires manual /idd-close after merge to enforce checklist gate + closing summary.
```

When `/idd-all` substitutes `${N}` with the actual issue number, the resulting markdown contains a real `Closes #559` (or whichever issue). GitHub's keyword regex (per Linking a pull request to an issue using a keyword) does not care about:

• Surrounding negation ("Do NOT add")
• Inline backticks / single-quotes
• The fact that the line starts with 🤖

…and auto-closes the referenced issue at merge time.

Reproduction(real-world, today 2026-05-14)

1. Run `/idd-all #559 --pr` on `kiki830621/ai_martech_global_scripts`
2. Skill writes PR body containing line: `Do NOT add 'Closes #559' — IDD discipline requires manual /idd-close after merge.`
3. PR #695 opened with that body
4. `gh pr merge 695 --squash --delete-branch`
5. Issue #559 auto-closed by GitHub — `closedByPullRequestsReferences: [695]`

Evidence:

• PR: https://github.com/kiki830621/ai_martech_global_scripts/pull/695
• Auto-closed issue: https://github.com/kiki830621/ai_martech_global_scripts/issues/559
• Closing summary had to be posted post-hoc since the close gate was bypassed: https://github.com/kiki830621/ai_martech_global_scripts/issues/559#issuecomment-4448693507

Impact

This is exactly the failure that `/idd-close` is designed to prevent:

"close 是人類 checkpoint(closing summary 含 root cause + solution + verification trail,該由人寫不該由機器猜)"
— idd-all/SKILL.md "鐵律" section

The skill's own PR template self-sabotages the discipline. Every `/idd-all --pr` run is vulnerable.

Suggested Fix

Three viable approaches:

Option A — Strip the keyword pattern entirely(simplest):

```
🤖 Generated by /idd-all. After merge, run `/idd-close #${N}` manually to write the closing summary (root cause + solution + verification). Do not rely on GitHub's auto-link keywords — IDD discipline requires explicit closure with audit trail.
```

The phrase "auto-link keywords" carries the meaning without triggering the regex.

Option B — Use a non-matching variant:

```
🤖 Generated by /idd-all. Do NOT add the auto-close trailer for #${N} — IDD discipline requires manual /idd-close after merge.
```

Drops the word "Closes" entirely; uses generic "auto-close trailer" reference.

Option C — Reformulate as positive instruction:

```
🤖 Generated by /idd-all. Next step: run `/idd-close #${N}` after merge to write the closing summary. (No auto-close trailers used in this PR body, per IDD discipline.)
```

Workaround(verified working in same session)

For PR #696(#560 cluster sister fix), I manually edited the PR body via `gh pr edit 696 --body ...` to remove the trigger phrase BEFORE merging. Result: `gh pr merge 696 --squash --delete-branch` did NOT auto-close #560, allowing the proper `/idd-close` discipline to run. Evidence:

• PR #696: https://github.com/kiki830621/ai_martech_global_scripts/pull/696
• Manually closed issue with full summary: https://github.com/kiki830621/ai_martech_global_scripts/issues/560
• Closing summary: https://github.com/kiki830621/ai_martech_global_scripts/issues/560#issuecomment-4448746979

Affected Code

`skills/idd-all/SKILL.md` Phase 5 — the heredoc that builds `PR_BODY`(currently in v2.59.0 at the bottom of Phase 5):

```bash
PR_BODY=$(cat <<EOF
...
🤖 Generated by /idd-all. Do NOT add 'Closes #${N}' — IDD discipline requires manual /idd-close after merge to enforce checklist gate + closing summary.

Same risk applies to `idd-all-chain` Phase 3 if its cluster PR body uses the same warning pattern — should also be audited.

## Priority

Suggest P2 — the discipline is real but the workaround(edit PR body before merge)is straightforward once spotted. Users who follow the template verbatim will silently bypass the close gate, which is the failure the IDD methodology is built to prevent. Worth fixing soon.

## References

- IDD discipline statement: `idd-all/SKILL.md` "鐵律" section + "verify is terminal phase" requirement
- GitHub auto-close keyword docs: https://docs.github.com/en/issues/tracking-your-work-with-issues/using-issues/linking-a-pull-request-to-an-issue
- Real-world incident PR: https://github.com/kiki830621/ai_martech_global_scripts/pull/695
EOF
)