bib-update: extract DOI/CrossRef/OpenAlex cascade into scripts/fetch_bibtex.py

[nsmiller2501]

Summary

Follow-on to #7. Hoists the deterministic surface of /bib-update's fetch cascade out of SKILL.md prose and into a standalone Python script at .claude/skills/bib-update/scripts/fetch_bibtex.py.

What changed

• New .claude/skills/bib-update/scripts/fetch_bibtex.py: encodes Sources 0–2 (DOI direct → CrossRef title+author → OpenAlex), the 3-signal match test (title fuzzy ≥85%, year ±1, first-author match), three-way agreement against the parsed filename stem, and citation-key rewriting. Emits a single JSON object with tier, source, bibtex, match_signals, and rejections.
• SKILL.md now describes how to invoke the script and how to handle each tier of result, replacing ~50 lines of inline curl / matching prose.
• allowed-tools augmented with Bash(python3:*) and Bash(~/.claude/skills/bib-update/scripts/fetch_bibtex.py:*).

Why

• The fetch cascade is deterministic: HTTP requests, JSON parsing, fuzzy-match comparisons. Running it through an LLM each invocation wastes tokens and exposes the logic to attention drift.
• The LLM-fallback path (Tier 3, when all network sources fail) is intentionally not in the script — fetch_bibtex.py returns "fallback-needed" so the model still constructs the unverified entry from the metadata block and blocks for user approval. This preserves the judgment-required step in the LLM layer.
• The venue-precedence override (preprint vs published) also remains in SKILL.md prose because it requires the model's judgment on filename venue tokens.

Testing

• Ran fetch_bibtex.py against several DOIs (Tier 1), CrossRef-discoverable papers (Tier 2), OpenAlex-only papers (Tier 2), and intentionally unresolvable working papers (Tier 3) — confirmed JSON output schema and the correct tier/source classification in each case.
• Spot-checked the 3-signal matcher rejects near-misses (e.g. wrong-year candidates and wrong-author candidates).
• No change in user-facing /bib-update behavior expected — same cascade, same output, same idempotency.