Merge #228 (0588d433) into fix/zs2r-harness-lock-gate

ci.yml: this branch's check-harness-lock --allow-network step is kept, ahead
of main's nix-build clippy and test steps that #228's merge brought in.
test-evidence/tooling.md: both EOF appends kept, no heading lost (42 = union).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze

.agents/skills/pr-watch/SKILL.md

@@ -12,12 +12,15 @@ scripts/pr-watch <pr-number> [--expect <sha>] [--timeout <sec>] [--interval <sec
 ```
 exit 0  every check COMPLETED, none failed, and MERGEABLE with a state of
         CLEAN, UNSTABLE or HAS_HOOKS
-exit 1  a check failed, or the PR is not mergeable (CONFLICTING, BLOCKED,
-        DIRTY, BEHIND, DRAFT, or a state it does not know)
+exit 1  a check failed (under any mergeability, BLOCKED included), or the
+        PR is not mergeable (CONFLICTING, DIRTY, BEHIND, DRAFT, or a state
+        it does not know)
 exit 2  the head moved during the wait, or is not --expect
 exit 3  timed out with checks still running, mergeability still UNKNOWN,
         or still BLOCKED with every registered check green
 exit 4  usage or environment error
+exit 5  the PR is MERGED or CLOSED, at the head the watch pinned; it ends on
+        the first poll that sees it closed, which may be mid-wait
 ```
 
 **Exit 0 now means mergeable, not only green.** GitHub computes mergeability