triage

# Repo Triage First-pass sweep of a repo you didn't build. Output is a report, not a diff. ## Guardrail (non-negotiable) If the repo's origin is outside the darkroomengineering org: **read-only. Never commit, never push, never open a PR** (incident 2026-07-07). Findings go in the report; the user decides what crosses the org boundary. Check first: ```bash git remote get-url origin ``` ## Pipeline 1. Record the current state with `git branch --show-current`, `git status --short`, `git log -1 --oneline`, and `git remote get-url origin`. Do not checkout, pull, fetch, reset, stash, or otherwise change an external repository. State that freshness against the remote is unknown unless the current checkout already contains evidence that proves it. 2. **Farolero coverage check.** Read `package.json` and record whether the repository declares `farolero`. Do not execute repository binaries during read-only triage, including `node_modules/.bin/farolero`: executable project dependencies can mutate state or expose credentials. If coverage is absent, note that `bun add -D farolero && bunx farolero baseline write` is an adoption path for the repository owner to run later. Do not install anything on an external repo. 3. Fan out `explore` agents in ONE message: - (a) structure + dependency freshness - (b) TypeScript/lint/config hygiene - (c) obvious perf and a11y issues on key pages - (d) security smells (exposed env, secrets in history, unpinned actions) 4. Rank findings: Cr...