feat(work-items): bug path reproduces twice and proves the fix before a draft PR #11865

Problem

/work-items:work says "Reproduce the reported failure FIRST" for bugs but has no bug path: no
second reproduction, no check of an existing fix, no before-and-after proof, no rule that the PR
stays a draft until that proof exists.

Origin: Lauren's bug bot (D43, Q527).

Fix

Add a bug path to /work-items:work:

• Reproduce twice through the real surface from a reset, or, when a fix may already exist, run
  verify-existing-fix: the baseline (the revision before the fix) reproduces twice and the patched
  build resolves it twice in the same environment, ending Confirmed, Insufficient fix or
  Inconclusive; it never opens a competing PR.
• Name the broken and the expected final state before the run.
• Write the failing test first when a cheap local target exists; otherwise say why it was skipped.
• Open a draft PR only with before-and-after proof (the same path run twice on the patched build);
  a compile or unit test alone is not after-evidence. Never merge.

The seven-condition fix gate (K3) and investigate-only mode (K4) are separate items; triage's
existing repro bar is unchanged.

Done when

• The work skill's bug path states the two reproductions, verify-existing-fix with its three outcomes, the named final states, failing-test-first, the draft-PR-only-with-proof rule and never-merge.
• Eval cases cover a confirmed repro and a verify-existing-fix "already fixed" outcome under plugins/work-items/evals/; python3 plugins/evals/skills/validate/scripts/validate-cases.py plugins/work-items/evals exits 0.
• bash plugins/skill-quality/scripts/check-skill.sh plugins/work-items/skills/work exits 0, and a work-items changelog fragment passes bash scripts/check-changelog-fragments.sh.

Parent: #7578