ai: apply changes for #862 (3 review threads)

Addresses:
  - #3592446970 at .github/workflows/reviewer-bot.yml:85
  - #3598366324 at .bot/config.yaml:66
  - #3598678252 at docs/superpowers/specs/2026-07-14-onboard-bot-engine-design.md:197

Author: peco-engineer-bot[bot]

.bot/config.yaml

@@ -51,7 +51,11 @@ pr_body_template: |-
 #     for when the active interpreter already has the deps.
 #   - `git diff` is pinned to HEAD-relative / index forms. A bare (git,diff)
 #     prefix would allow `git diff --no-index /etc/passwd /dev/null`, reading
-#     arbitrary ABSOLUTE paths and bypassing safe_path.
+#     arbitrary ABSOLUTE paths and bypassing safe_path. Pinning to `HEAD` also
+#     defeats the `git diff HEAD --no-index <abs> <abs>` prefix-match variant:
+#     with a revision (HEAD) present git is in tree-diff mode and rejects paths
+#     outside the repo (`fatal: '<path>' is outside repository`), so --no-index
+#     cannot escape the worktree — verified on the runner.
 #   - `cat`, `ls`, `find` are deliberately ABSENT — they read arbitrary absolute
 #     paths (the bash tool validates only the argv PREFIX, not path args). The
 #     agent has read_file / glob / grep for repo-relative reads, all safe_path-

docs/superpowers/specs/2026-07-14-onboard-bot-engine-design.md

@@ -30,8 +30,9 @@ is in scope, matching what the repo runs today.
 
 ## Engine pin
 
-- **Engine SHA:** `d780b2da60bb1ac68bb5cd1acb7cabf495b3ff2d` (current
-  `databricks-bot-engine` `main` HEAD).
+- **Engine SHA:** `d780b2da60bb1ac68bb5cd1acb7cabf495b3ff2d` (this section
+  reflects the original reusable-workflow draft; the SHA actually installed by
+  the shipped local-composite workflows is tracked in the Reviewer update below).
 - The SHA is used in BOTH the `uses:` ref AND the `engine-ref:` input of each
   caller, so the workflow definition and the installed engine match. Never
   `@main` (force-pushable; the job carries secrets).
@@ -194,9 +195,10 @@ databricks-bot-engine, adopting **both** bots and used to surface onboarding
 friction back to the engine.
 
 ### Reviewer — flipped to PAT-free App-auth
-Pinned to engine SHA `d24ca2171d191a652a67f4f43995f0959c9a5791` (post-#107, which
-selects the engineer author flow from the issue **Type** — Bug ⇒ bug-fix, Feature
-⇒ enhancement; earlier drafts pinned `b6205fb`, post-#100). Both reviewer
+Pinned to engine SHA `d9cb1e63dc31eed550194a29d1cfd7de9c9c793b` (post-#107, which
+selects the engineer author flow from the issue **Type** — Bug ⇒ bug-fix,
+Task/Feature ⇒ task (the engine renamed the old `enhancement` flow to `task`);
+earlier drafts pinned `d24ca217`, then `b6205fb`, post-#100). Both reviewer
 workflows pass `engine-auth: app` and **drop `engine-pat`**: the reusable mints a
 short-lived, engine-scoped GitHub App installation token from the review-bot App
 creds it already receives. No `BOT_ENGINE_PAT` secret. The same SHA is pinned in