gh-shim: refuse GitHub writes from worker shells with a report-to-parent instruction
A worker shell carries the read broker and never a write ticket, so a write such as gh issue comment from it could never succeed. It used to end in the governance-unavailable refusal, which told the agent to retry. Now any write-class command from a worker shell is refused up front, before the manifest lookup, the rung probe and any broker or relay traffic, with exit 86 and the approved text:
gh-shim: gh_shim_worker_write_refused: workers cannot write to GitHub; report what should be posted to your parent instead
Unchanged: worker reads still go through the broker. Head-session writes still route through the relay. Credential commands from a worker (gh auth token, auth status --show-token, auth login) keep their existing gh_shim_operator_credentials refusal.
Tests check the exact line the agent sees (through a test-only refusal sink), six write shapes with zero delegation, identity lookups, relay requests or broker connections, a brokered worker read and a routed head write that refuse nothing, and the credential commands. 417 gh_shim tests pass on Linux; Windows target check with -D warnings passes.
Summary by cubic
Worker shell GitHub writes are now refused up front instead of ending in the governance-unavailable refusal that looped the agent back to retry.
The refusal exits with 86 and the exact line gh-shim: gh_shim_worker_write_refused: workers cannot write to GitHub; report what should be posted to your parent instead, before manifest lookup, rung probe, or any broker/relay traffic. Worker reads, head-session writes, and credential commands (gh auth token, auth status --show-token, auth login) keep their existing behavior.
- Adds a test-only refusal sink so tests assert the exact rendered refusal the agent sees.
- Covers six write shapes with zero delegation or lookups, brokered reads, routed head writes (stabilized with a seeded cached rung so the test never depends on live discovery timing), and credential refusals.