feat(skills): end-of-sync reconciliation sweep for security-issue-sync

[potiuk]

Summary

• Adds Step 5d — End-of-sync reconciliation sweep to security-issue-sync: after the apply phase and before the recap, reconcile three dimensions over every tracker in the run — board Status column, milestone, and RM assignee hand-off at fix released.
• Unconditional backstop: today these only move when a Step 1d signal fires, so between-run drift (hand-edited labels, a release that shipped since last sync, a hand-off announced in a rollup but never applied to the assignee field) silently persists.
• RM hand-off rule: always hand off at fix released; when a follow-up is still open, hand off and post a guard note telling the RM to hold the advisory — a withheld assignee is the wrong signal.

Motivation

Surfaced running a live bulk sync: the per-issue assessors moved most trackers correctly but silently missed the RM hand-off on two fix released trackers and left several board columns stale at PR merged / Needs triage. The signal-gated moves in signals-to-actions.md can't catch drift that produced no signal; a guaranteed end-of-sync sweep can.

Migration for existing adopters

No new config knob and nothing to opt into — the sweep is universal on next /magpie-setup upgrade. The confirmation model is preserved: pure label-derived reconciliation (column move, RM swap to the looked-up release manager, assigning an already-existing milestone) applies without extra confirmation, while state-creating actions (new milestone, ambiguous date) and the outbound guard note still follow propose-before-apply. Relates to the capability:reconciliation work in #337.

Test plan

• prek run --files skills/security-issue-sync/apply-and-push.md skills/security-issue-sync/SKILL.md — green (markdownlint, typos, lychee, check-placeholders, skill-and-tool-validate).
• Exercised the sweep by hand on a full bulk sync: 14 board-column corrections + 8 RM hand-offs applied, ambiguous milestone flagged rather than guessed.

🤖 Generated with Claude Code