feat(pr-workflow): add /mms-debug orchestrator

[MajorLift]

Summary

• Adds debug, the symptom-first sibling of evidence. evidence is handed a claim and looks for the observation that would falsify it; debug is handed a symptom and has to generate the hypothesis before anything can falsify it.
• Routes a symptom to the engine that owns its defect class — memory-leak, race-condition-repro, react-render-delta, sentry-grafana-correlation, extension-errors-debugging, tsc-blindspots, supply-chain-audit. It chooses among engines; it does not reimplement any investigation, so both orchestrators share one engine set.
• Carries evidence's trust gates, which bind harder here: a weak instrument in review produces a claim someone challenges, in debugging it produces a theory nobody checks.
• Killed hypotheses are part of the output — deleting them makes the survivor look inevitable and hands the next investigator the same dead ends.

Two disciplines it can lean on, added in #106

debug routes a symptom to the engine that owns its defect class. Two skills in #106 sit a level below that, on the moves this orchestrator makes before any engine is chosen:

• distinguishing-observation — enumerate every mechanism that could produce the symptom, then design the observation that separates them. The instinct is to instrument the mechanism you already suspect, which yields evidence consistent with your hypothesis and equally consistent with the three you never wrote down. It also names the pairs that are genuinely indistinguishable from outside — a swallowed error and an unreached code path, a cache hit and a correct recomputation, a retry that succeeded and a call that never failed — so the move is to add the separating signal rather than read further.
• observability-gap — establish what signal exists on a path before reading more of it, and distinguish absent from suppressed, since a log filtered by level, sample rate or a flag is a different problem from one that was never written. Its worst case is instrumentation that exists but is off in the environment where the bug occurs, because the signal appears to be there.

Both live in coding next to flaky-test-detection. They are not engines and do not belong in the routing table — they are what makes the routing decision well-founded, which is why they are skills rather than sections of this one.

Note: extension-errors-debugging (#44) is currently routed to by no orchestrator, since it is not evidence for a PR claim. This gives it an entry point.

Test plan

• node .github/scripts/lint-skill-entry.mjs domains/pr-workflow/skills/debug/skill.md — 0 errors, 0 warnings
• Frontmatter: name matches directory, maturity: experimental, description within the 1536-char budget
• Every engine named in the routing table exists or has an open PR

[MajorLift]

Context budget

What this PR costs an agent, measured from an install rather than read from the diff. Three tiers, and only the first is unavoidable.

Skill	Frontmatter	Selected	+ refs & knowledge
debug	1,151 chars	~1,716 tok	~1,716 tok

Frontmatter is the only tier paid unconditionally — every agent loads it on every run once the skill is installed, used or not, because it is what the agent reads to decide relevance. The 28 skills across the eleven open skill PRs sit at a median of ~1,716 tokens selected and ~1,860 with references followed. All are within the 1,536-character description budget.

Selected is paid only when the agent picks the skill. + refs & knowledge is the ceiling if every bundled reference is then read; it is a worst case, not an expectation.

Method

tools/install --repo metamask-extension --maturity experimental against this branch at 703242599, measured per installed skill directory. Repo overlays are merged into the emitted SKILL.md, so they land in the selected tier rather than being missed by a source-byte count. Token figures are bytes/4 — a proxy for scale, not accounting.

These figures are pinned to the commit above and drift on every push; #96 tracks automating them.