[HugoXK]

Written-by: HugoXK

Adds independent Product/Test stage sessions and token rotation tooling.

• New scope and verify job kinds routed to the Product/Test DSH sessions via sessionId.
• Scope returns scope/acceptance/testPlan; verify returns testRed/testGreen; neither creates a branch or PR.
• Stage mode queues verification before review; work items get Product scope and Test verify actions.
• Evidence gates and stage labels updated for scope/verify.
• Added scripts/rotate-instance-tokens.mjs with dry-run, active-job guard, rollback and deploy docs.
• Updated the mock with the stage actions.

Ran:

• npm run check — pass (138 tests, build)
• node scripts/version.mjs check — pass
• node scripts/changelog.mjs check — pass
• node --check bridge/flybot-bridge.mjs — pass
  Not run: production deploy (will restart bridges after merge).

No-issue: remaining P2 work from the product review.

[HugoXK]

Verdict: PASS at d39ad32
Written-by: Reviewer
Posted-by: HugoXK

Ran:

• npm run check — pass (138 tests, build)
• node scripts/version.mjs check — pass
• node scripts/changelog.mjs check — pass
• node --check bridge/flybot-bridge.mjs — pass
  Not run: production deploy.

The leaked GitHub PAT still needs the owner to create a replacement; the script rotates Fledge-managed instance tokens.

[HugoXK]

Verdict: PASS at 600aac0
Written-by: Reviewer
Posted-by: HugoXK

Ran:

• npm run check — pass (138 tests, build)
• node scripts/version.mjs check — pass
• node scripts/changelog.mjs check — pass
• node --check bridge/flybot-bridge.mjs — pass
  Not run: production deploy.

Bridge docs now cover the scope/verify stage contract.