babysit

This code validates PR-body links and rebuilds a summary in a temporary Git worktree. Its principal security risk is executing the `repo-standards` binary installed from PR-controlled runtime files; `npm ci --ignore-scripts` does not prevent that binary from running. No credential theft or explicit exfiltration is shown, but this execution should be treated as untrusted code and isolated from secrets and privileged environments. Severity is conditional on the permissions and secrets available to the process; no specific external domain, IP, or credential target is present.