Isolate CPAN report PR merges from tester checkout

[fglock]

Summary

• require CPAN report PR creation, inspection, and merge to run from a neutral non-worktree directory
• require an explicit GitHub repository argument so merge-time branch cleanup cannot mutate the tester checkout
• forbid chronological incident logs in AGENTS.md and skills; integrate reusable prevention into the relevant guidance instead
• broaden the shell-quoting guidance to prevent command substitution from backticks in any double-quoted argument

Live-test result

PR #1122 successfully published and merged a lock-consistent report snapshot. The report checkout had no newer edits to lose, but gh pr merge --delete-branch switched it to master and fast-forwarded it. This correction prevents that local side effect.

Validation

• skill validator: pass
• make check-links: pass, 0 errors
• direct offline link check for AGENTS.md and the skill: pass, 0 errors
• full build and runtime tests not run; documentation and non-executable skill instructions only