Operator-gated drift tail of the plugin-sync cluster (#3688 follow-ups, post-wipe tracking)

[kyle-sexton]

Tracking issue for the operator-gated tail of the claude-ops plugin-sync cluster (#3733, #3728, #3734, #3681, #3688, closed 2026-09-08). Filed because the authoring host is being wiped on 2026-09-15 and this list lived only in gitignored .work/handoffs/ files there. Everything below waits on an explicit operator go; nothing is in flight. The last open thread of the cluster itself is #3835 (host-local probe, re-plant recipe on that issue).

Adjacent drift list, one worktree and PR each, only after a go

• (a) claude-code-account-rotation gets a .claude/settings.json with the SessionStart hook and marketplace, delivered by the standards sync manifest like claude-settings-github-iac (a standards change plus one sync). Unprobed whether this is already tracked: gh issue list -R melodic-software/standards --search "account-rotation settings" and the same in claude-code-plugins and github-iac.
• (b) ci-workflows release.yml:126 error text points at a file that exists (workflow-string edit, no logic change).
• (c) ci-workflows README ~line 89 "v0.7.0" version line.
• (d) standards managed-files-guard README acceptance bullet (~166-170) naming the dependabot[bot] arm.
• (e) github-iac .github/dependabot.yml:61-62 ignore widened to melodic-software/ci-workflows/* like the other four.
• (f) the ci-workflows fix(repo-hygiene): git-tree-reset AppliedClean no longer claims success when git clean failed (#395) #590 header sentence on consumer repins, one clause.
• (g) the claude-bot plugin SessionEnd hook path (upstream claude-community marketplace bug; disable the hook or file it).

Waiting on a ci-workflows release

• Structural managed-files-guard fix: move actions/checkout into the composite action and drop the step from the standards component. Operator-gated on the release.

Operator-only

• Add "Bash(gh pr merge *)" beside the other gh pr rules in ~/.claude/settings.json (only the --auto variants exist; a session cannot add it, the classifier denies it as self-modification). On a fresh host this is part of settings seeding.

Context a cold agent needs

• Same-plugin PRs in this repo conflict by construction on the plugin version bump and the CHANGELOG top-insert; never stack two claude-ops PRs on one branch or run them in parallel.
• Every hop of this chain used one Opus implementer per item with a fresh-context verifier; gh pr merge may be classifier-denied once, then ask.
• save_point.py in session-flow < 0.35.18 drops Original-goal bullets below Opening ask:; 0.35.18 fixes it (fix(session-flow): carry amendment bullets below the predecessor's Opening ask #4164).