Pilot: adopt core:setup-repo in a Python repo

[jonnyspicer]

First real-world adoption of the core:setup-repo skill (shipped in PR #1) to validate it end-to-end and start the org-wide consistency rollout.

Goal

Run core:setup-repo against one existing Python repo and land the standard setup: .claude/settings.json (marketplace + core), CLAUDE.md, shared rules, the corrected Claude review workflows, and the Python tooling (ruff/pytest, uv-based CI).

Candidate repos

retina-gui or retina-tracker (both Python; retina-gui already trends to the SF/ruff defaults).

Steps

• Ensure core@offworld is installed at user scope (/plugin marketplace add offworldlabs/claude-shared, /plugin install core@offworld).
• In the target repo, run "set this repo up per claude-shared" (invokes core:setup-repo).
• Review the scaffolded files; reconcile anything the skill skipped because a file already existed.
• Add the CLAUDE_CODE_OAUTH_TOKEN repo secret and land the review workflows on the default branch (see docs/runbooks/github-actions-claude-review.md).
• Open a normal PR and confirm a claude[bot] review comment posts (also fixes the "green review, no comment" permission issue on that repo).

Acceptance criteria

• The repo has the standard .claude/, workflows, and tooling with no clobbered pre-existing files.
• A PR gets an automated Claude review comment.
• Any friction found in the skill's interactive procedure is filed as a follow-up.

[jonnyspicer]

Pilot complete on retina-tracker (offworldlabs/retina-tracker)

core:setup-repo (python stack) run and standardization merged via retina-tracker PR #12 (squash).

Acceptance criteria met:

• Standard .claude/ (settings + rules), .editorconfig, uv-based ci.yml, and both corrected review workflows landed — no pre-existing file clobbered (engine skipped the 7 existing files; those were reconciled by hand).
• The "green review, no comment" bug is fixed on this repo: verified on a separate non-workflow PR (Phase 2: add ts-frontend and ts-backend stacks to core:setup-repo #13) that a real claude[bot] review comment posts. Token scope confirmed PullRequests: write / Issues: write; the comment posted with findings.

Friction found (filed as follow-ups):

• setup-repo: core claude-code-review.yml lacks track_progress/allowedTools #7 — core claude-code-review.yml needs track_progress + --allowedTools (write perms alone don't post).
• setup-repo: ci-python.yml does not install a packaged repo (import fails) #8 — ci-python.yml doesn't install a packaged repo → pytest ImportError (used pythonpath = ["."]).
• setup-repo: detect .gitignore that ignores .claude/ #9 — skill should detect a .gitignore that ignores .claude/ (would silently drop scaffolded config).
• setup-repo: rules templates ship as TODO placeholders #10 — rules templates ship as TODO placeholders.
• setup-repo: public-repo hardening for write-perm workflows #11 — public-repo hardening: author_association guard on claude.yml (applied here), fork/pull_request_target guidance, SHA-pinning.

Note: retina-tracker is public, which surfaced security considerations a private pilot would not (#11).