readme --write clobbers READMEs generated by the repository's own tooling #71

Status: Reported by agent sessions during the rollout. The mechanism was checked by reading the code; the failure was not re-run on current main.

Part of epic: Epic: Make README generation safe for existing repositories.

Summary

A repository whose README starts with <!-- Generated by scripts/render_docs.py … --> had its marker deleted and headings demoted by readme --write, so its own render_docs.py --check failed. The session reverted the change.

Evidence

• The marker is present in the public pick-your-ai-leaderboard README (verified).
• The failure of the repo's check after --write was reported by the session that ran it (not re-run).

Impact

A rollout PR would break the repo's CI or be overwritten by its generator.

Proposed fix

Detect generated-README markers (and a readme: managed config key) and refuse with needs-input:readme-managed.

Acceptance criteria

• Managed READMEs are never rewritten; the log says why.
• Config can mark a README managed.

Tasks

Each task below is a sub-issue.

Prior work

Prior work: open PR #20 (opt-in --allow-t3 and the Pick Your AI family), open #7 and PR #13 (variant J badges), merged PRs #14 to #19 (icon art-direction path, UTF-8 output, registry-free org health and label planning, Windows test portability, footer URL repair) and closed issues #8 to #12. Nothing here duplicates those; where an item is already handled it is linked, not refiled.

Fresh VM verification: not run. Findings were verified on a Windows host; hosted CI is separate evidence.