[gurnben]

Summary

The harness's core loop — audit, triage, patch, verify — was four manual invocations whose wiring lived in the skills' docs. This PR adds flow commands that chain the stages through their artifacts, with each stage running as an ordinary background run (own journal, result, attach session):

• flow audit-triage <repo> — secure-code-audit, then triage of its report with --auto (headless-safe). Output: the triaged findings (<repo>-triage.json) — the explicit hand-off point.
• flow remediate-verify <findings> <repo> — patch from the triaged findings (or an audit report), then verify-remediation against a fresh clone of the target with the generated PATCHES applied (conflicting patches skipped, not fatal).
• flow full <repo> — the whole loop end to end.
• flow status [id] — list flows / show per-stage state, run ids and artifacts.
• The pipeline worker derives each stage's inputs from the previous stage's result.json artifacts; a failing stage fails the flow with later stages left pending; stop signals cancel the current stage gracefully. Interactive flows follow stage-by-stage (Ctrl-C detaches without cancelling); every stage is inspectable with attach/result/logs since they're normal runs.

Verification

• Live end to end against the fake harness and a real git target: all four stages chained (audit report → triage input, triage JSON → patch input, PATCHES applied to the verify checkout — the patched file verifiably changed), flow status showing stage detail.
• Tests: artifact chaining (phase-1 output wired into phase-2 input, --auto included), failure propagation (later stages pending), and buildPatchedRepo against real git repositories (applicable patches apply, conflicting ones skip).
• The fake harness is now skill-aware (writes the artifact matching the prompted skill), which the chaining tests rely on.
• Full suite with race detector, vet, staticcheck clean.

💘 Generated with Crush