fix(unic-archon-dlc): explicit staging and host-agnostic repo pinning in the Archon Boxes

[orioltf]

Why

Archon 0.7.0 removed git add -A from its own bundled command defaults (coleam00/Archon#1506) and pinned every gh call to the origin repo (#2361, issue #2229). Both defects were live in this plugin's Boxes.

Blind staging. /explore's preserve-spike ran git add -A, and /build's open-pr said "stage everything changed by the build". A Box runs in an isolated worktree with fresh context, so "everything changed" sweeps in whatever else is on disk — scratch files, and build-state.json as the loop rewrites it on every one of up to 60 iterations.

Unpinned host CLI calls. No gh or az invocation passed a repository. gh resolves the base repo by its own remote precedence (upstream > github > origin), so on a fork clone a PR opens — or is read, merged, or commented on — against the upstream parent.

What changed

Area	Change
unic-dlc-explore.yaml	preserve-spike stages named paths, then verifies with git status --porcelain
unic-dlc-build.yaml	Loop phases stage by name; open-pr gains an explicit stage list
unic-dlc-qa.yaml	verify-pr-base and merge pin the repository
unic-dlc-pr-review.yaml	prep and post pin the repository
All four Boxes	bootstrap reads project.repo_ref; new guard-no-repo-ref node cancels when it is missing
lib/config-schema.mjs	New optional project.repo_ref, defaulting to null (+ 4 tests)
commands/specs.md, tickets.md	Named staging in both gates; PR and tracker calls pinned
commands/cleanup.md	Stale-PR close pinned; category skipped when repo_ref is unset
AGENTS.md	Doctrine bullet for maintainers

Both rules are stated inline in every prompt, not only as doctrine: a Box node is self-contained and imports nothing from the plugin (ADR-0023 §5), so a doctrine document is invisible to a running node.

Design notes

• build-state.json is committed exactly once, at open-pr. Every loop phase writes it to disk and is told explicitly not to stage it. It is ADR-0012's anti-cheat proof (red_exit, red_unexpected_pass, per-slice phase order), which previously died when /cleanup pruned the worktree.
• repo_ref stays optional. It is not in MANDATORY_PATHS and /setup is untouched — promoting the key belongs with the 0.7.0 adoption (AC7). Each Box instead cancels with an actionable message naming the key and /unic-archon-dlc:setup (ADR-0011: expected precondition failures cancel, they do not fail).
• Empty is treated as missing. Upstream found that gh pr list --repo "" exits 0 and silently falls back to the host's own resolution, so a blank value has to be caught by the guard rather than by the CLI.
• Config, not git remote. Upstream derives the pin from git remote get-url origin. This plugin reads project.repo_ref instead, because it must stay host-agnostic across GitHub and Azure DevOps. Every prompt says so inline, so a future reader does not "fix" it back to match upstream.
• The two $ARTIFACTS_DIR meanings are disambiguated in every deny list: Archon's per-run environment variable (outside the repo, never staged) versus the in-repo artifacts_dir config value (whose session files are committed).

Out of scope

Promoting project.repo_ref to mandatory, and the rest of the 0.7.0 surface (version floor, evidence_policy, always_run) — per the issue's own scope note.

Verification

pnpm --filter unic-archon-dlc test (104 pass), pnpm --filter unic-archon-dlc typecheck, pnpm ci:check, and verify:changelog all pass. Version bumped to 0.12.1 with a dated changelog entry.

Fixes #289

🤖 Generated with Claude Code