Orchestration skill: lanes never delegate their audit to /code-review

.claude/skills/orchestration/SKILL.md

@@ -20,6 +20,7 @@ A charter is the task prompt a subagent receives. Requirements:
 - When two reference sources disagree, the charter names the conflict for adjudication — it never silently picks one. A charter's factual claims are no more trustworthy than a builder's until verified.
 - A charter for any agent whose output ships anywhere public — code, copy, test fixtures, an issue, a PR body, review comments — forbids personal data from real Discord data (usernames, user ids, message content) unless strictly necessary, and when the source material the charter hands over (an issue, a transcript) itself carries real names, the charter lists those exact strings as a deny-list. Before shipping, the orchestrator greps the diff and the published artifacts for them: the generic prohibition alone has failed twice — a real person's email shipped inside a published investigation issue, and a real name traveled from an issue's text into a tool's schema copy and test fixtures despite a charter clause forbidding it, costing a remediation cycle.
 - Instruct agents to run slow verification commands (`pnpm run tsc`, `pnpm run test:unit`, `pnpm run test:e2e`) synchronously in the foreground. A workflow agent that backgrounds a check and ends its turn waiting on a notification is terminally stalled — its turn ending is final.
+- A lane never invokes the built-in `/code-review`: its reviewer forks with the session's working directory, so from inside a worktree lane it reviews whatever branch the main checkout holds — and runs the gates there, which may be the live installation. The lane hand-audits its own diff; the independent review is the orchestrator's fan-out over the lane's committed branch.
 - Write each new charter/script fresh with the Write tool. Deriving one by programmatically splicing a previous one introduces silent syntax errors.
 - A parameterized script must parse `args` defensively (string-or-object) and hard-throw on any missing required field — a silently-undefined interpolation produces a plausible-looking empty result that reads as a clean pass.
 - A slice that ships an MCP tool, a gateway handler, or an ingestion path must drive that surface live at least once — a real MCP client session over stdio, or a scripted gateway event through the real business function — before handoff. A unit-only exit bar passes code whose query crashes at runtime or whose tool schema rejects every real input.