prm: stop attempting remote branch deletion where the proxy blocks it - #277

Problem

/prm's close-out step 5 assumed every environment could delete a remote ref. In
a proxied web session (Claude Code on the web) it cannot: the egress proxy returns
HTTP 403 on the git-receive-pack POST that carries a ref deletion, and the
GitHub MCP surface exposes no delete verb at all (create_branch exists; nothing
deletes a ref).

The result was every web close-out burning turns on pushes that can never land,
then reporting the failure as if it were a finding.

Confirmed in-session: an ordinary push (branch create) through the same proxy
succeeds, so it is ref deletions specifically that are refused — not git writes
in general. The 403 carries no X-Github-Request-Id while the ref advertisement
to the same host seconds earlier returns 200 with one, so it is generated in
front of GitHub — credentials, gh scopes and branch protection are not the
cause.

Changes

skills/prm/prm.md

• New environment bullet for a proxied web session, alongside Local and Remote
  (mobile/codex), with a one-shot probe (curl -sf "$HTTPS_PROXY/__agentproxy/status")
  run once before the close-out and remembered for the whole run.
• Step 5 is treated as out of scope in that environment: nothing attempted,
  nothing reported, branches absent from the ledger.
• Corrected the remote-environment note, which claimed sub-step 5 ran "as usual"
  over gh — the line that licensed the wasted attempts.

skills/prm/reference.md

• Step 5 leads with the probe, records the exact 403 signature so a future run
  recognises it immediately, and states why it is not credentials/scopes/branch
  protection — heading off the "try a different token" reflex.
• Explicit instruction to write no ledger line about branches there: not
  "deferred", not "blocked", not "see /repo_cleanup". The step would say the same
  thing on every close-out, so it is noise rather than a finding.
• Fallback for any environment that surprises us: stop after the first refusal,
  do not repeat the push per repo, do not narrate the failure.

Why silence loses nothing

/repo_cleanup Bucket B enumerates origin branches directly
(gh api repos/<owner>/<repo>/branches), so it rediscovers these branches on the
next local sweep without being handed a list. Checked before pointing at it — the
handoff does not depend on prm reporting anything.

The ledger's "a skipped step must read as skipped" rule keeps its force and gains
one stated exception: a sub-step the environment makes impossible is omitted
outright. Skipping something that could have been done still gets a line.

Repo-side, enabling "Automatically delete head branches" (Settings → General →
Pull Requests) removes the need for the sub-step altogether.

Docs-only; no executable code paths touched.

Generated by Claude Code