Delegate push, draft PR, and the CI-green loop to the implementer subagent

[ikuwow]

Purpose

The implementer subagent stopped at local commits, so the parent agent was left running the CI-green loop by hand: push, watch checks, read the failure log, fix, push again. That is mechanical repetition on the most expensive agent in the session, and it left two cases with no delegated path at all — work that only CI can verify (no local environment for it), and follow-up commits on an existing PR, where the commit was delegated but the push that makes it visible was not.

This moves "get the branch to a green draft PR" into the implementer by default, and keeps the parts that need judgment — the PR body's rationale, code review, ready-for-review, merge — with the parent.

Key changes

• The implementer now pushes, opens a draft PR, watches CI, and fixes failures on its own. This is default behavior for every dispatch, single or parallel; the parent opts out with "do not push" or "commits only". Branch and worktree creation stay with the parent.
• Its PR body is a fixed placeholder and its title is prefixed WIP:. A plausible-looking body written by a subagent invites the parent to lightly edit it instead of writing the real one, so an obvious stub is the safer artifact — what matters is that the PR exists. /pr-selfcheck already fails a stub body on PR Body Checklist items 1 and 6, so nothing has to remember to catch it.
• Guardrails against the failure modes this opens up: a cap of 3 fix-and-push rounds, a ban on going green by weakening the check (deleting or skipping tests, continue-on-error, disabling a rule, loosening an assertion), report-don't-fix for failures the diff did not cause, and an explicit force-push ban. The default-branch precondition treats an unresolvable origin/HEAD and a detached HEAD as failures rather than passes, since no hook covers pushes.
• The git-workflow skill gains one state-based step (skip PR creation when the branch already has one) and no implementer-specific conditionals. Knowledge that the implementer exists stays in implementation-delegation.md so either side can change without dragging the other along.
• The permission allowlist gains the two push forms git-essentials.md already prescribes, which is what lets the loop run unattended.

Notes

Those allowlist entries are deliberately narrow. A broad Bash(git push *) was the first attempt, and the review found it silently auto-approves two paths the deny list misses: git push origin +main, which forces via plus-refspec, and git push origin HEAD:main, which puts a feature branch straight onto the default branch. Granting only the two prescribed forms covers the documented procedure with no new surface, and anything else still prompts.

The new rules are not deployed until this merges, so this PR itself was pushed and opened by the parent. The delegated path gets its first real exercise on the next delegated task.

Verification

• pre-commit run --all-files → all hooks pass except Check userscript version bump, which fails identically on main (userscripts/ime-enter-fixer.user.js: content changed but // @version was not bumped) and touches no file in this diff
• jq empty claude/settings.json → exit 0
• Every gh and git command quoted in the new instructions checked against --help on gh 2.96.0; git symbolic-ref --short refs/remotes/origin/HEAD confirmed to exit 128 when origin/HEAD is unset, which is why that case is now an explicit precondition failure
• Behavioral check on the next delegated implementation task: the implementer pushes, opens a WIP: draft PR, and reports its ## PR / ## CI sections