triage

# Repo Triage First-pass sweep of a repo you didn't build. Output is a report, not a diff. ## Guardrail (non-negotiable) If the repo's origin is outside the darkroomengineering org: **read-only. Never commit, never push, never open a PR** (incident 2026-07-07). Findings go in the report; the user decides what crosses the org boundary. Check first: ```bash git remote get-url origin ``` ## Pipeline 1. `git checkout main 2>/dev/null; git pull` — triage latest, note the default branch. 2. **Farolero sweep (if available).** If the repo declares `farolero` in package.json and `node_modules/.bin/farolero` exists, run `node_modules/.bin/farolero report --json` (exit 0 always; operational failure just skips this step). Fold the JSON into the ranking: `byRule` gives per-standard counts, `byArea` names the debt hotspots — cite both in step-4's findings table, and include the `baseline` object verbatim in the report as the ready-to-commit adoption path (`farolero baseline write` produces exactly these numbers). If farolero is not installed, note in the output that the repo has no farolero coverage and that `npm i -D farolero && npx farolero baseline write` is the adoption path — do not install anything on an external repo (read-only guardrail applies). 3. Fan out `explore` agents in ONE message: - (a) structure + dependency freshness - (b) TypeScript/lint/config hygiene - (c) obvious perf and a11y issues on key pages - (d) security smells (exposed env, secrets in histor...