Harness classifier blocks in-scope signed commits relayed through subagents (orchestrator → pr-manager) — authorization-grant treated as scope-limit

## Summary

When the orchestrator spawns pr-manager with an initial prompt that contains scope-guard text such as \"do NOT auto-fix\" (a correct intent: prevent agent scope expansion at spawn time), and the orchestrator **later** authorizes a specific fix via SendMessage relay, the Claude Code harness classifier still blocks the commit attempt because the original in-prompt text remains visible in the subagent's context. The classifier honors the in-context phrase as a hard scope-limit and cannot see the relayed authorization as an override.

Effect: the subagent refuses to make the in-scope, signed, authorized commit, and the orchestrator has to drop down and execute the commit + push from the orc workspace directly. Net cost: 2+ round-trips per affected event.

## Two observed instances (meets the second-instance / systemic threshold)

1. **PR #4 cycle (akey, 2026-06-29):** orchestrator spawned pr-manager with \"do NOT auto-fix\" as scope guard. After CI defects surfaced, orchestrator authorized fixes via SendMessage. Classifier blocked the commits; orchestrator committed directly from orc workspace. 2 round-trips per defect × 3 defects.
2. **PR #8 cycle (akey, 2026-06-30, this session):** pr-manager again refused a coordinator-relayed authorization. Same pattern.

Per `.claude/rules/tooling-friction.md` second-instance threshold, this is now systemic, not one-off.

## Root cause hypothesis

The harness classifier evaluates scope-limit phrases as content of the **persistent agent context** and does not have a mechanism to recognize that a later SendMessage from the coordinator constitutes an **authorization-grant** that overrides the original scope-limit. The asymmetry is structural: spawn-time prompts are durable; relay messages are ephemeral and treated as request input, not as policy updates.

This is partly a harness concern (classifier ergonomics) and partly an engine concern (orchestrator-skill spawn-prompt template uses negative phrasing — \"do NOT X\" — which the classifier latches onto more strongly than positive scope statements).

## Suggested fix shape

Two layers, both helpful:

1. **Engine (orchestrator-skill spawn-prompt templates):** Replace negative-form scope guards (\"do NOT auto-fix\") with positive-form scope statements (\"your authorized actions are: review, comment, report; commits require explicit coordinator authorization per fix\"). Same intent, but the positive form makes a SendMessage-relayed authorization fit the stated scope rather than contradict it.
2. **Engine + harness contract:** Document the relay-authorization pattern explicitly in the orchestrator skill, and have pr-manager (and other workflow-coordinating agents) emit a structured `relay-grant: {action, target}` envelope that the classifier can match against the original scope statement.

## Severity

**P1 — frequent in autonomous PR loops.** Every story PR cycle with CI defects hits this. Workaround exists (orchestrator commits directly) but defeats the agent decomposition.

## Cross-references

- #343 / #346 / #347 / #348 (other PG-N defects from the akey pipeline)
- akey HANDOFF-PHASE-3-ENTRY.md §PG-2