feat(nightshift): ship as a pull request, not straight to main

A night of autonomous work needs a review gate, especially on a live repo.
Output is now one branch and one PR rather than commits on the default
branch.

Separates committing from pushing, which had been conflated. Local commits
are what protect against an agent dying mid-task, and they cost no CI, so
they stay at every milestone. Pushing is what triggers CI, so it becomes a
deliberate act: at the end, when parking, or on request. A night of
milestone pushes is a night of CI runs on work that was half-finished at
the time, which trains the user to ignore the build.

Subagents are told to commit locally and explicitly not to push.

Covers both forges: gh for GitHub, the API for Gitea (no tea CLI on most
setups), and reporting a compare URL rather than faking success if auth
fails.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019SSXDKsik8yYrezStVaDXt

skills/nightshift/SKILL.md

@@ -46,7 +46,7 @@ Repeat until done or stopped:
 4. **Decompose** into subtasks with **disjoint file ownership**.
 5. **Delegate** — subagents, in parallel where files don't collide.
 6. **Review** what returns. Their reports are the product as much as the code.
-7. **Commit and push.** Every milestone. Non-negotiable — see "assume you will be killed".
+7. **Commit locally.** Every milestone, non-negotiable — see "assume you will be killed". **Do not push** on every milestone; see "shipping".
 
 ## 4. Limit discipline
 
@@ -67,7 +67,7 @@ How to act on it:
 
 - **Window looks heavy** (well into millions, and climbing fast across recent milestones): finish what's running, commit, push, and **park**. Do not dispatch new agents.
 - **Parking** = `ScheduleWakeup` for the time `oldestAgesOutInSeconds` reports, plus a margin. Sleeping until the window loosens is strictly better than having three agents killed halfway through their tasks.
-- **Before parking, always**: commit, push, and write the current state and the next intended step into the log. The run must be resumable by a different session that has none of your context.
+- **Before parking, always**: commit, push (parking is one of the deliberate push points, see §8), and write the current state and the next intended step into the log. The run must be resumable by a different session that has none of your context.
 - **If an agent dies on a limit error anyway**: do not immediately retry. Check the tree still passes the gate, commit whatever is green with a message stating plainly that it is **unverified** and what was left half-done, then park.
 - Never *silently* burn the window to zero. If the user is asleep, they will wake to a stalled run and no explanation.
 
@@ -82,7 +82,7 @@ What actually works, learned the hard way:
 - **Ask for disagreement, explicitly.** "Report anything you think I got wrong" produces the highest-value output in this whole flow. Subagents repeatedly find that a spec is wrong, a tuning knob is dead, an interface is frame-coupled. Treat a pushback as a finding, not friction.
 - **Demand verification the task can actually support.** "Tests pass" is not enough for anything a human will look at or listen to. Require a screenshot, a measured number, a browser run. Say plainly when something can only be verified by a human.
 - **Model choice**: strongest model for design-heavy or feel-critical work; a cheaper one is fine for mechanical, well-specified changes.
-- Instruct them to commit and push their own work when it's coherent, so a killed agent loses less.
+- Instruct them to **commit their own work locally** when it's coherent, so a killed agent loses less — and explicitly **not to push**. A dozen subagent pushes is a dozen CI runs on half-finished work.
 
 ## 6. Reviewing what lands
 
@@ -103,16 +103,33 @@ Keep two documents:
 
 This is what makes an overnight run reviewable by a human who slept through it. Include what is **not** done and what only a human can judge.
 
-## 8. Assume you will be killed
+## 8. Shipping: one branch, one PR, reviewed
+
+**Never push to the default branch.** The output of a run is a **pull request**, so a human can review hours of autonomous work before any of it lands. This matters most on live repos, which is exactly where this skill will be used.
+
+- All work goes on **one branch** in the worktree. Subtasks commit to it **locally**.
+- **Push is a deliberate act, not a milestone habit.** Every push runs CI, and a night of milestone pushes is a night of CI runs on work that was half-finished at the time — noisy, expensive, and it trains the user to ignore the build.
+- **Push when:** the run finishes, you park on a limit, or the user asks. That's it.
+- **Then open the PR** describing what landed, what is unverified, what you decided and why, and what needs a human. The build log (§7) is most of that text already.
+
+Forge-agnostic:
+- **GitHub** — `gh pr create --fill` (or `--draft` for a long run still in progress).
+- **Gitea** — no `tea` CLI on most setups and `gh` is the wrong forge. Use the API with the token from the git credential store; `POST /api/v1/repos/{owner}/{repo}/pulls` with `head`, `base`, `title`, `body`. **Never print the token.**
+- If auth fails, **do not fake it**: push the branch and report the compare URL so the user can open the PR themselves.
+
+If the run is long and the user wants visibility, one **draft PR pushed early** is a reasonable compromise — a single CI run up front, then quiet until the end. Ask, or state that you're doing it.
+
+## 9. Assume you will be killed
 
 Limits, crashes, closed laptops. Therefore:
 
-- Commit and push at every milestone, and whenever the tree is green.
+- **Commit locally at every milestone**, and whenever the tree is green. A local commit already survives a killed agent — which is the failure mode this is defending against, and it costs no CI.
 - Never leave the only copy of anything in an agent's context.
 - A commit of unverified work is fine **if the message says so**. A commit that implies verification that never happened is not.
+- **Push before parking**, always. Parking may last hours and the session may not survive it.
 - Leave the next step written down, in the repo.
 
-## 9. Stopping
+## 10. Stopping
 
 Stop when the goal is met, when what remains needs a human decision, or when further iterations cannot make progress. Say plainly what is done, what is untested, and what needs the user.