[jlipworth]

Summary

Makes outside pull requests cheap to review by flagging the ones that touch essential surfaces, and says plainly that a PR may be re-implemented rather than merged.

• .github/triage/sensitive-paths.txt is the single list of sensitive paths, grouped by category: signing and entitlements, auth and credentials, the transcode profile, dependencies, CI and release tooling, App Store text, agent instructions (CLAUDE.md, AGENTS.md, .claude/, .codex/), and policies.
• scripts/check-sensitive-paths.py lists the matching files for a PR (--pr N), a branch (--base REF), or a list of paths. For PRs it also checks the old path of renamed files. It is read-only and never checks out PR code.
• The new sensitive-paths label has been created. Under BOT-POLICY the bot applies it and names the matched categories, without judging whether the change is safe. It never removes the label.
• docs/CONTRIBUTING.md and the PR template: PRs are proposals. The maintainer may merge one or re-implement it with credit, and sensitive-path changes usually get re-implemented.
• CLAUDE.md: before proposing to merge someone else's PR, run the checker, report every match, and review those files line by line.

GitHub Actions is disabled for this repo, and Woodpecker has no token that can label PRs, so the label is applied by the bot (or by hand), not by CI.

Linked issue

None. This is a follow-up to #348.

Affected surface

• Platforms: none (tooling and docs)
• Backends: none

Verification evidence

• Commands run and results:
  • 5 new unit tests pass.
  • scripts/ci-hygiene.sh passes locally: strict MkDocs build, link and Mermaid checks, tooling tests.
  • Checker on recent PRs: Prune redundant tests and the dead code they covered #346 finds nothing; Prune archives; fix Mac upload signing and archive-based validation #342 finds the TestFlight script and both skill mirrors; this branch finds 5 files.
• Simulator / host / device evidence: not applicable, no app code.
• Not verified (and why): the bot behavior. The bot runs on the maintainer's own accounts.

Privacy checklist

• No tokens, client identifiers, passwords, or signing/team identifiers.
• No real server hostnames, IPs, or URLs.
• No usernames, media titles, filenames, library paths, or personal home-directory paths.
• Security-sensitive changes were discussed privately first (n/a).

AI assistance

Claude Opus via Claude Code wrote the change. The maintainer reviews it.