contributor-pr

# contributor-pr — external PR intake pipeline Proven on v1.125.2 (PRs #144/#145 by @Alien10140 — Gemini defaults + the headless deep-prompt 502 fix). External code gets a stricter path than our own branches: fork CI does not auto-run, review claims are verified empirically, and merges need explicit user authorization. ## Phase 1 — Review (local runs ARE the CI gate) 1. Fork PRs from first-time contributors show **"no checks reported"** — GitHub Actions waits for maintainer approval. Don't chase it; the local full-suite run below substitutes, and push-CI on main re-validates after merge. (Approving runs via `gh api …/actions/runs/<id>/approve` and `gh pr merge` are both classifier-blocked for external PRs — when blocked, STOP and hand the user the exact commands; never work around.) 2. `git fetch origin pull/<n>/head:pr-<n>` and read the FULL diff. Extra scrutiny on LLM surfaces (`prompts.mjs`, `routes/llm.mjs`), sanitizers, any new ingress, and i18n snapshot regeneration (dup keys / glosses). Check the contributor's tests honor CI isolation (dynamic imports in `before()`, `CAREER_OPS_ROOT` mktemp — the paths-once rule). 3. **Verify factual claims against live sources, never training data.** v1.125.2 lesson: an AI review called `gemini-3.6-flash` "fabricated" as a BLOCKER; fetching https://ai.google.dev/gemini-api/docs/models proved the contributor right (3.6-flash Stable, 2.0-flash shut down). Model ids, API shapes, deprecations → We...