feat(stage7e): wire the generic pipeline to consume the interview/config at runtime

[thomasluizon]

Stage 7e of the harness-upgrade (orbit-ui-mobile/.claude/research/harness-upgrade-plan.md → build-checklist 7e). Makes the generic pipeline skills read the interview/config at runtime instead of assuming any one tracker, forge, or SDLC convention — decomposed by tier, nothing baked into /execute. Zero Orbit leakage; everything config-driven.

Builds on 7a (#1) + 7b (#2) + 7c (#3) + 7d (#4), all merged. Branched off main.

What changed

Surface the resolved tracker driver into config

generate.mjs buildConfig now emits issueTracker.driver — the host + chosen tool binding setup resolves via trackers.mjs (a CLI, an MCP, or a REST fallback). This fulfils setup-harness.md's promise that the recorded tracker binding is "what the pipeline's issue-creating skills use later" — previously answers.tracker was recorded but never surfaced, so the skills had nothing to read. Falls back to the host's generic driver label when express mode captured no tool. Documented in workflow.config.example.yaml; host enum expanded to github | gitlab | azure | jira | linear | bitbucket | none.

Lift every hardcoded tracker/forge/squash leak to a {{config.*}} ref

• prime / plan / implement — read & comment issues through {{config.issueTracker.driver}} for {{config.issueTracker.host}}; no bare gh.
• stories — one canonical per-host driver reference (github/gitlab/azure/jira/linear/bitbucket/none, aligned to trackers.mjs), driven by the resolved driver; the last bare gh issue view is gone.
• ship — opens the PR through the git host's PR tooling (forge-neutral, host-qualified examples) against {{config.pr.baseBranch}}; emits the commit trailer only if {{config.pr.commitTrailer}} is set and never a {{config.pr.forbiddenTrailers}} one.
• validate / pr-review / investigate — already read per-repo *Cmd, the config-gated parity/i18n/contract dimensions + the opencode-gated adversarial Phase 6 / second-opinion, and the config.investigate.* incident bindings, so the 7d-generated specialized investigate/ship overlays resolve against one core body — one skill, no dual copies.
• thermo-nuclear — dropped the squash-merge assumption (merge per {{config.pr}}).

Zero-leakage guardrails as runnable gates

• check-genericity.mjs — the hardcoded-gh exemption now requires a tracker-scoped config ref (config.issueTracker | config.pr) on the same line, not any config ref — closes the hole where an unrelated {{config.paths.*}} laundered a baked-in tracker CLI.
• NEW scripts/test-wiring.mjs (CI-gated, self-testing detectors) — asserts every pipeline body reads its required {{config.*}} values and that no skill body carries a bare (non-host-qualified) tracker/forge CLI, a Co-Authored-By trailer, an unconditional squash-merge, or a literal branch prefix in a git command.

Gates (all green locally)

check-genericity · test-hook-engine · test-setup · test-generate (+ a new issueTracker.driver assertion) · test-wiring · adapters-sync. LF-only, no NUL bytes.

🤖 Generated with Claude Code