feat(vetted-ops): save large reads to the workspace, and add the pr-management reads

[potiuk]

Summary

• vetted-op-read --save NAME writes a read's output to <workspace>/saved/NAME and prints one JSON line, so large reads (a whole PR sweep) reach a deterministic tool instead of the agent's context.
• New read operations for what pr-management-triage and pr-management-stats compute on: triage sweeps in one TriagePR shape (open / label / author / review-requested / one PR, all pages), triage pre-flight, recent main-branch failures, the action_required index, runs and check runs at a head, commits-behind, team members, and the stats open / closed reads.
• Bottom of a stack: the triage and stats PRs on top consume these reads.

Security notes

vetted-op-read runs outside the sandbox, and --config can name a policy the agent wrote, so the policy's workspace proves nothing. --save therefore:

• writes only into a saved/ directory that already exists and holds a .vetted-ops-save marker — it creates neither, so it can never write where the caller could not already write;
• writes to an exclusive temp file and renames it into place, so a planted symlink or hard link is replaced, never written through;
• is refused for writes and procedures.

Every search string is built with repo:<upstream> from policy first; parameters only narrow it. Tests cover marker absence, symlinked dir / marker / target, hard links, open workspaces, write ops and failed reads.

One-time setup per machine: mkdir -m 700 <workspace>/saved && touch <workspace>/saved/.vetted-ops-save.

Type of change

• Python package (tools/*/ with pyproject.toml)
• Cross-cutting (sandbox)

Test plan

• prek run --all-files passes (whole tree, at the top of the stack)
• uv run pytest / ruff check / mypy for tools/vetted-ops

RFC-AI-0004 compliance

• Sandbox — the new write path cannot reach a directory outside what the caller could already write
• Write-access discipline — read operations only

---

Was generative AI tooling used to co-author this PR?

• Yes — Claude Code (Opus 5). I reviewed the diff and the test results; commits carry Generated-by:.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FTTd3HMcMsj7FwkhPPQcSx