fix(agentic-engineer): let the deployment decide whether external PRs may be merged #214

🤖 Generated by the Agentic Engineer

The generic Agentic Engineer role still forbids merging external-contributor pull requests, while the deployment that runs it has allowed that since 2026-08-08. The role and its consumer contract give opposite instructions for the same PR, and the role wins by default because it is the file the runtime loads.

Evidence

• plugins/agentic-engineering/agents/agentic-engineer.agent.md (step 4, at main on 2026-09-15): External-contributor PRs are static-review-only: never merge them, never enable auto-merge on them, and never check out, build, or execute their branch code.
• The consumer contract (devantler-tech/monorepo AGENTS.md, You own EVERY pull request in the portfolio) records a maintainer direction from 2026-08-08 that outside contributions are the engineer's to drive and merge. Their branches stay never-run-locally, and there are extra conditions before the merge: a current-head green review and a recorded CI-based evaluation.
• The same contradiction exists in the bundled portfolio-maintenance skill, which devantler-tech/agent-skills authors (tracked separately there).

Who is affected

Every scheduled engineer run. An outside contribution that meets every gate is parked by the generic role, which is the passive self-blocking the consumer contract forbids.

Expected behaviour

The generic role keeps the execution guardrail unconditionally: never check out, build or run an external branch. Whether an external PR may be merged, and under what extra conditions, is resolved from the deployment's Trust gate and merge policy, not fixed in the generic text. A deployment that never allows it keeps today's behaviour.

Acceptance criteria

• Step 4 separates "never execute an external branch" (unconditional) from "may merge" (deployment-resolved), and fails closed to no merge when the consumer contract does not grant it.
• Auto-merge on an external PR stays forbidden (it merges a head nobody evaluated).
• The plugin's manifest/contract validation pins the new wording so it cannot silently revert.

Rough size: small (one paragraph plus its validation).