Track rhdh-plugins gaps against the rhdh-agentic Fullsend reference install

[durandom]

Context

rhdh-agentic is the QE/reference installation for Fullsend. The
rhdh-plugins runtime installation should follow it instead of carrying
repository-local workflow, harness, or agent customizations. Repository-specific
trigger scope and contributor guidance may remain alongside that installation.

The synchronization work in
rhdh-plugins#3740
removed the old runtime overrides and established which previous capabilities
are now provided centrally or through portable repository guidance.

Resolved discrepancies

• Public-repository command authorization: Fullsend v0.30.0 performs the
  collaborator permission check in the managed reusable dispatcher. Slash
  commands require repository write access, so the old repository-local shim
  gate is no longer needed.
• Selective pull-request scope: rhdh-plugins retains
  pull_request_target.paths restrictions for workspaces/boost/**,
  workspaces/scorecard/**, and workspaces/ai-integrations/**.
• RHDH monorepo workspace routing: rhdh-plugins provides a portable
  repository skill at .agents/skills/rhdh-workspace/SKILL.md, exposed through
  .claude/skills. A minimal Fullsend instruction file requires agents to use
  it for workspace work.
• Lingering Jest processes: .fullsend/AGENTS.md requires non-interactive
  Jest execution and explicit TaskStop cleanup for auto-backgrounded
  verification commands, following Fullsend waits for hard timeout after Claude emits successful result #26.

Remaining discrepancy

• Stale fix-branch handling: the old installation rebased and force-pushed
  the PR branch before fix runs. The reference installation intentionally has no
  repository-owned rebase hook, so fix runs may still start from a stale branch.

Desired outcome

• Decide whether stale fix-branch handling belongs in Fullsend core, the shared
  agents repository, or the rhdh-fullsend installation blueprint.
• Implement it centrally rather than restoring a repository-specific hook.
• Validate the change in rhdh-agentic before promoting it to rhdh-plugins.

[durandom]

Update from rhdh-plugins#3740: we are retaining the existing pull_request_target.paths restriction for workspaces/boost/**, workspaces/scorecard/**, and workspaces/ai-integrations/**. The public-repository discrepancy in this issue is therefore narrowed to issue-comment authorization; selective PR scope is intentionally preserved in the repository workflow.

[durandom]

Further update from rhdh-plugins#3740: the rhdh-workspace capability is being preserved as a repository skill at .agents/skills/rhdh-workspace/SKILL.md, with .claude/skills -> ../.agents/skills, following Fullsend's current user guide. It no longer requires a Fullsend harness/config customization, so the monorepo workspace-routing bullet is resolved by correct placement.