## What

<!-- One sentence: what does this PR do? -->

## Why

<!-- Why is this change needed? -->

Closes #

## Scope

- [ ] Search pipeline
- [ ] Channel (specify: )
- [ ] Skills / PROTOCOL
- [ ] CI / hooks / infra
- [ ] Docs / config

## Test

- [ ] `pytest -m "not network"` passes
- [ ] `ruff check && ruff format --check` passes
- [ ] New/changed code has tests

## Security Impact

- New permissions or capabilities added? `Yes / No`
- Secrets / tokens / API keys handling changed? `Yes / No`
- New outbound network calls or external endpoints? `Yes / No`
- If any Yes — risk and mitigation:

## Root Cause (bug fix only — otherwise delete this section)

- Root cause:
- What guardrail was missing:

## Evidence

- [ ] Failing test / log before + passing after
- [ ] Screenshot or trace
- [ ] Perf numbers (if relevant)

## Revert

<!-- If this breaks something, how to roll back? -->
