Run only when the user explicitly invokes /finalize.

Take a branch from "dev work done" to "PR open" in this repo. Read docs/agents/skills.md for frontmatter, provenance and index rules, and the git skill's sub-skills/code-review.md, sub-skills/commit.md and sub-skills/create-pr.md for those workflows. Work the steps in order.

Steps

Diff base. Measure the branch against a fixed point:
- Upstream tracked: git merge-base @{u} HEAD.
- Else git merge-base --fork-point <default-branch> HEAD when it succeeds.
- Else the merge-base of the default branch (gh repo view --json defaultBranchRef -q .defaultBranchRef.name) with HEAD.
- Unresolved: ask the user for the fixed point.
Code review. Follow git code-review against the fixed point, including its security loop. Done when it reports.
Skills-check. Follow security skills-check with scope fixed to every skill folder under skills/, regardless of what the branch touched. Skip source-skills/ and .agents/skills/. Done when each skill has a verdict. Treat each BLOCK or DANGER verdict and each Critical or Warning finding as a finding to fix in step 4; list Info findings in the summary.
Fix findings. Fix every Standards, Spec and skills-check finding directly. Keep the list of what was fixed. A finding you judge a false positive goes to the user with the quoted evidence instead of being fixed.
Docs site. The site is the public skills reference. When the branch added, moved, renamed or re-described a skill or sub-skill, or bumped metadata.version, run pnpm exec vp run site:build and site:check, and update any site/*.md copy that is now stale. The catalogue is generated, so edit the source in skills/, not the output.