fix(restore,#17633): inline CoursIA README-totals review rule into pr-review prompt

[jsboige]

Summary

ai-01|CoursIA asked the hermes-agent workspace (global dashboard [ASK] 2026-09-24 08:50Z, arbitrage user) to apply the new README-totals review rule for CoursIA README PRs. The canonical rule lands in CoursIA .claude/rules/pr-review-discipline.md via jsboige/CoursIA#17633, which is still open — and main still carries the superseded clause ("audit fichier ENTIER des comptes", §E) that the new rule retires.

So the rule is inlined into the bot's hermes-pr-review prompt by a new idempotent restore section 5f, taking effect immediately and surviving rebuilds (prompts are not regenerated elsewhere — same pattern as 5b/5c/5e).

What the directive says

• A CoursIA README PR whose substance is a totals bump (notebook counts, per-language/subfolder counts, cell counts, "N notebooks" banners) → CHANGES_REQUESTED. Those numbers belong to catalogue regeneration (CATALOG-STATUS, feat: add opencode-zen model provider with live model fetch NousResearch/hermes-agent#2651): a wrong count line is deleted, not refreshed.
• It takes precedence over the old §E "whole-file audit" clause: it frames those PRs instead of rejecting them.
• After a notebook is added, a README PR must deliver the body presenting that notebook (section, navigation lines, takeaways, paths), faithful to the notebook.

Two defects found by exercising 5f live, not by reading the diff

1. The first version guarded on a marker string that never matched the injected heading (README-TOTALS #17633… vs README-TOTALS CoursIA #17633…), so every run appended a new copy — two blocks observed in jobs.json.
2. The block text contained backticks. This python source sits inside a double-quoted bash string, so the shell command-substituted them before python saw the text (gh: accepts 1 arg(s), received 2).

Fix: 5f normalizes (strip any existing copy with a tolerant regex, re-append one canonical block) instead of append-if-absent, and carries no backticks.

Test plan

Exercised live in the container against /opt/data/cron/jobs.json:

• run 1 → (re)applied, prompt converges to a single canonical block
• run 2 → already canonical (no-op) (true idempotence)
• sh -n syntax OK, pure LF, no deletions in the diff (claudish-hub sections untouched)
• 192.168.0.50:3000 hub lines still present (×4) — the 15/09 claudish-2 bascule is not reverted

🤖 Generated with Claude Code

[github-actions]

૮ >ﻌ< ა ci review

_{ran on 8cb2a9a — fix(restore,NousResearch#17633): inline CoursIA README-totals review rul}

❌ Job failures

Python lints / Windows footguns (blocking) · View job

Job Python lints / Windows footguns (blocking) failed.

---

Python lints / ruff enforcement (blocking) · View job

Job Python lints / ruff enforcement (blocking) failed.

---

⚠️ Warnings

CI timings · View report · View job

Wall time 1450m3s vs 3m53s (+37240.3%). 1 job(s) slower, 2 faster, 1 unchanged.

• OSV scan / Emit review status: -99.0s
• Detect affected areas: -51.0s
• OSV scan / Scan lockfiles / osv-scan: +10.0s