Changes touching this path

• the afk loop learns which hunt opens the night, so a security or perf run files its own tickets against a stated bar instead of the backlog being the only place the night's work can come from b8f63e6a · dbf3dbe6…
• afk-loop no longer tells the implementing subagent to run the implement skill, which a subagent cannot invoke and whose last step commits to a git branch a lane lacks: its implement-in-a-subagent step now hands the subagent a new sibling brief, IMPLEMENT-BRIEF.md, derived from the procedure recent runs inlined, with the ticket, lane and primary filled in. the brief states the split (the subagent implements, tests and describes, and never signs, lands, writes through git or writes to GitHub), has the subagent read the ticket comments and each blocker state reason itself (the hand-off half of #1853), carries the build job cap, the cargo fmt ban, the empty-filter count rule, mutation proofs and the prose checks, and points at BINARIES.md and AGENTS.md for what they own. the review sweep no longer credits implement with a per-ticket review, and HUNT-SECURITY names the subagent instead. a planted home-directory path in the brief turned runbook_portability red (2 passed, 1 failed), BINARIES.md now cites the portability test at its crates/loot-first path, where #1082 moved it, and the workspace suite is green (#1815) 03446134 · dbf3dbe6…diff
• the live-database checks test-main.yml runs can run locally, from the same script CI runs, because the account is out of Actions minutes and a land never ran them: the provisioning, the database keys and the suites move out of the workflow into ci/test-main.sh, which builds every connection URL from a host and a port it requires rather than defaulting to the one a real cluster listens on, and the workflow keeps only what prepares a fresh runner and calls it. ci/local.sh starts a throwaway Postgres on its own port, refuses if anything already answers there, runs that script against it and deletes the cluster on exit, so it runs beside a real cluster and from a lane before a land. run in a lane against a portable Postgres 18.6 it applied forge migrations 0001 to 0017 and the three site migrations, and 122 cargo test results and all seven site live files passed with LOOT_FORGE_TEST_REQUIRE_DATABASE set, so none skipped, before and after the review fixes. with the returning alias put back into read.ts it failed at the site step on syntax error at or near returning, and pointed at the port a real cluster owns it refused with exit 2. the CI-shape pin reads through the script and its STEPS list, because the job is still named cargo test --workspace and a check on the workflow text alone would pass on the name after the command had gone; it went red when the workflow stopped calling the script and when the script dropped --locked. the comments and living docs that said the workflow sets the keys now say the script does, the dated ADR and evidence entries are left as history, and AGENTS.md, docs/agents/workflow.md and the afk-loop security hunt point at the script. the Actions wiring itself is unexercised until minutes return (#2061) 8ff6117c · dbf3dbe6…diff

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.