feat(agents): wire contract + verify + security into feat/bugfix/hotfix (verify-loops lot 4)

lib/verify-secure-loop.md: shared main-loop include. GATE 1 fresh verifier
(blind, contract from disk) → CONFORME straight to GATE 2, ECARTS loop max
3; GATE 2 fresh security-auditor (MODE gate) → PASS to commit, BLOCK loop
max 3 with re-verify-request-FIRST order invariant. Mute agent never a PASS.

feater.md: STEP 0.7 CONTRACT (proportional, silent on a clear feature) +
STEP 3 VERIFY+SECURE via the include. Nominal = one verifier + one security
dispatch; the loop only costs when it loops.

bugfixer.md: STEP 3.5 CONTRACT fed by the DIAGNOSIS (bug report verbatim +
reproduced-then-gone + regression test criteria) + STEP 5 fresh gates via
the include. Renumbered STEP 5 sub-steps (gates before the commit gate).

hotfixer.md: STEP 1.7 CONTRACT (silent autofill, zero questions) + STEP 3
security gate whose FAILURE REVERTS (git restore to pre-flight SHA + escalate
to /bugfix), never loops — the 1-attempt model preserved. No fresh verifier
at hotfix weight (the smoke-check verifies the trivial contract). Adds the
Agent tool to hotfixer.md + hotfix/SKILL.md for the security dispatch.

lib/tests/loops-light.test.sh: 27 structure locks green, shellcheck clean.
Behavioral pipeline dogfood on a fixture (feat adding a feature WITH a SQLi):
GATE1 CONFORME (feature present, SQLi not a conformity gap — orthogonal
gates) → GATE2 BLOCK(1) (checklist caught the %-interp SQLi semgrep's taint
rules missed) → [fix to parameterized] → re-verify CONFORME (order invariant,
feature intact) → re-scan PASS. Loop converges to green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XpphkdTosUzokBDNG7PToS

agents/hotfixer.md

@@ -1,13 +1,15 @@
 ---
 name: hotfixer
 description: Quick fix for superficial bugs (typos, CSS issues, config errors, off-by-one, wrong variable name, missing import, broken link). Max 2 files, obvious root cause only.
-tools: Read, Edit, Write, Bash, Grep, Glob
+tools: Read, Edit, Write, Bash, Grep, Glob, Agent
 ---
 
 # HOTFIX — Quick Superficial Fix
 
-Fast-track fix for obvious bugs. No planning overhead, no plugin
-check, no subagents. Get in, fix, verify, get out.
+Fast-track fix for obvious bugs. No planning overhead, no plugin check.
+The fix is inline (no dev subagents); a fresh security gate runs before
+commit, and any gate failure reverts — never loops. Get in, fix, gate,
+get out.
 
 ## REQUEST
 $ARGUMENTS
@@ -39,6 +41,18 @@ skip). For a RECURRING or urgent bug only, a quick blockers-only glance may save
 If a prior BLK names this bug, jump to its solution. Not mandatory; no RELATED MEMORY
 disposition required at hotfix weight.
 
+## STEP 1.7 — CONTRACT (silent autofill)
+
+Run `$HOME/.claude/lib/contract-interview.md` at hotfix weight: **zero
+questions ever** (a hotfix is an obvious fix by definition). Autofill the
+contract — REQUEST verbatim = the bug description as given; ACCEPTANCE
+CRITERIA = "symptom gone; build/tests green"; FILE SCOPE = the 1-2 target
+files. It writes `.claude/tasks/contracts/<date>-<slug>-<HHMM>.md`. This is
+the reference for the security gate's scope and the escalation report if a
+gate fails. No verifier is dispatched at hotfix weight — the STEP 3
+smoke-check already verifies these trivial criteria; the gate hotfix adds is
+security (below).
+
 ## STEP 1.5 — DESIGN GATE
 
 Follow `$HOME/.claude/lib/design-gate.md`:
@@ -102,18 +116,32 @@ Apply the minimal change that fixes the bug:
      (Files were not yet staged — restore is safe.)
    - STOP and tell user: `"Hotfix introduced a regression. Reverted. Escalate to /bugfix or /analyze for deeper investigation."`
    - Do NOT commit a broken fix.
-3. Commit using conventional format (only after verify passes):
+3. **Security gate (fresh auditor) — failure REVERTS, never loops.** Dispatch
+   a FRESH security-auditor (`subagent_type: security-auditor`, or load
+   `agents/security-auditor.md`) with `MODE: gate`, `SCOPE:` the working-tree
+   diff vs the pre-flight SHA. Parse its `SECURITY — VERDICT:` line:
+   - `PASS` (or `DEGRADED` with no BLOCK) → proceed to commit.
+   - `BLOCK(n)` → this is hotfix: do NOT loop. Run `git restore .` to the
+     pre-flight SHA, print the `BLOCKING` list, and STOP:
+     `"Hotfix introduced a security finding. Reverted. Escalate to /bugfix
+     for a fix under the full verify+security loop."` The hotfix model is
+     one attempt; any gate failure (smoke OR security) reverts and escalates.
+   - Structural failure (mute / unparsable / no VERDICT line) → treat as a
+     failed gate: retry ONCE fresh; a 2nd structural failure → revert +
+     escalate. A mute auditor is never a PASS.
+4. Commit using conventional format (only after verify AND security pass):
    ```
    fix(<scope>): <what was wrong>
 
    Co-Authored-By: Claude <noreply@anthropic.com>
    ```
-4. Print summary:
+5. Print summary:
    ```
    HOTFIX APPLIED
    FILE(S) : <changed files>
    FIX     : <one-line description>
    VERIFIED: <test name or smoke check that passed>
+   SECURITY: <PASS | DEGRADED (checklist only)>
    ```
 
 ## STEP 4 — DOC SYNC (automatic)