feat: software-engineering skill GitHub guarantees

- G0/G0.5: repo freeze items (new vs existing, owner/repo, default branch,
  visibility); new-repo creation and first commit are G1 prerequisites.
- One branch per thread (feat/swe/<phase>-<role>-<short>), never push main
  directly, never force-push main; sync main before PR, coordinator
  resolves conflicts, never silently.
- Delivery requires a PR with scope, contract version, test evidence,
  known issues and linked todos/PRD items; no PR number means not done.
- Merge gate: Checks green, directory ownership pass, frozen contract
  version, coordinator approval, no unresolved review comments.
  Branch protection (require PR, require Checks, block direct push) is a
  GitHub repo setting; if unset, coordinator records it as risk and
  enables it, never pretends it is protected. GET /tasks/{id}/pr/checks
  is read-only diagnostics, never reruns or approves.
- Merge commit by default; merge record holds PR number, merge commit
  hash, CI run link and executor; delete remote branch after merge.
- Per-client release tags (e.g. v0.1.0) from merged PRs; rollback is
  revert or redeploy previous tag, never force-push rollback.
- Security: tokens/keys never in code, commits or command lines;
  token only into subprocess env (cloud/pr.py GIT_TOKEN pattern);
  .gitignore covers secrets and local config.
- Main text and appendix (coordinator, client, acceptance) updated in
  sync; appendix travels inside SKILL.md for seeding.

cloud/tests/test_software_engineering_github.py

@@ -0,0 +1,30 @@
+"""software-engineering 技能的 GitHub 保证：轻量关键词断言。
+
+只断言正文与附录都含有 GitHub 保证的关键概念，不逐字背诵全文：
+主分支保护、merge commit、revert 回滚、PR 号要求、force-push 禁止、
+tag 发布、token 只进子进程环境。附录是播种随附版，正文改了附录
+没同步时，本测试在附录部分就会失败。
+"""
+
+import unittest
+from pathlib import Path
+
+SKILL = Path(__file__).resolve().parents[1] / "skills" / "software-engineering" / "SKILL.md"
+
+KEYWORDS = ("主分支保护", "merge commit", "revert", "PR 号",
+            "force-push", "tag", "子进程环境",
+            "GET /tasks/{id}/pr/checks")
+
+
+class SoftwareEngineeringGithubTestCase(unittest.TestCase):
+    def test_github_guarantees_in_body_and_appendix(self):
+        text = SKILL.read_text(encoding="utf-8")
+        main, sep, appendix = text.partition("## 附录：角色模板")
+        self.assertTrue(sep, "appendix marker missing")
+        for kw in KEYWORDS:
+            self.assertIn(kw, main, kw)
+            self.assertIn(kw, appendix, "appendix: " + kw)
+
+
+if __name__ == "__main__":
+    unittest.main()