internal-sandbox-checklisted

# Sandbox check Manual guard after editing a plugin skill or a domain script. Reports whether each changed item has a paired scenario edit, verifies the first changed scenario headlessly, and prints the interactive re-test command for the user to launch against the rest. Verification runs without a human opening a session. `scripts/sandbox/run.sh` drives a skill through `claude -p`, provisions the scenario itself, and returns a verdict. An item that still ships unverified names which gate stopped it. ## Guards - If the current branch is `main` or `master`, stop: `❌ On main. Checkout a feature branch first.` - If both `git diff "$(git merge-base main HEAD)" --name-only -- 'claude/skills/**/SKILL.md' '.claude/skills/**/SKILL.md'` and `git diff "$(git merge-base main HEAD)" --name-only -- 'scripts/**' 'src/**'` are empty, stop: `✅ No skill or script changes since main.` ## Step 1: collect changed files Run in parallel from the worktree root: ```bash git diff "$(git merge-base main HEAD)" --name-only -- 'claude/skills/**/SKILL.md' '.claude/skills/**/SKILL.md' ``` ```bash git diff "$(git merge-base main HEAD)" --name-only -- 'scripts/**' 'src/**' ``` ```bash git diff "$(git merge-base main HEAD)" --name-only -- 'scripts/sandbox/**/*.sh' ``` ```bash pwd ``` The four lists, in order: - The changed skills, both plugin (`claude/skills/`) and internal (`.claude/skills/`) - The changed scripts (`scripts/`, `src/`) - The changed sandbox scenarios - The current root, whether t