feat(toolchain): add a per-file baseline mode, the lint rollout rule and a break-glass setting to /toolchain:ratchet #12140

Parent #7584's outcome is that "/review:ratchet becomes /toolchain:ratchet with a per-file baseline mode". The move landed in #11355, and #8543 left "the per-file baseline mode, lint rollout rule and break-glass team setting" to a later ratchet slice that was never filed. The owner's decisions (poteto-review decision row 64, approved 2026-10-14, and interview Q23, accepted) say:

• lint rollout is codemod-then-error when the fix is mechanical, otherwise a per-file baseline at error severity, using the linter's native baseline where one exists and the ratchet for counts with none;
• this matches Lauren Tan's "fail only when a change adds more";
• warn severity is used "only as a dated step" (Q23);
• break glass is "her inline exception with a reason, an expiry and a human's approval, as a team setting";
• the owner prefers fail-and-agents-fix.

The reason for per-file mode, from the proposal (decision row 36) that row 64 approved: "one repo-wide count lets a fix in one file pay for a new copy elsewhere". On main, plugins/toolchain/skills/ratchet/SKILL.md keeps one count per counter. Its script is a generated copy of plugins/performance/scripts/ratchet.py (scripts/shared-copies.txt).

Done when

• A test shows that a fix in file A does not pay for a new violation in file B: check exits 1 naming file B even though the total count fell. The test fails against main's ratchet.py and passes with the change.
• plugins/performance/scripts/ratchet.py (the canonical copy) gains a per-file mode:
  • the ceilings file records one ceiling per file for a counter;
  • check fails when any file's count rises above that file's ceiling;
  • propose-tighten lowers per-file ceilings as counts fall.
    The toolchain copy is regenerated by scripts/sync-shared-copies.sh, and CI's copy check passes.
• plugins/toolchain/skills/ratchet/SKILL.md states the lint rollout rule: a mechanical fix gets a codemod and then error severity; otherwise a per-file baseline at error severity; warn severity only as a dated step with its end date in the ceilings entry.
• The skill names the linter's native baseline as the per-file mechanism where one exists, and the ratchet's per-file mode for counts with none. Each named native mechanism is a pointer to the linter's own docs with an as-of date and a recheck trigger (.claude/rules/skill-bodies-state-current-rules.md), not a restated flag list.
• Break glass is defined:
  • it is an inline exception carrying a reason, an expiry date and the approving person;
  • a setting in plugins/toolchain/.claude-plugin/plugin.json userConfig, with a repository key the skill names, turns it on or off;
  • the skill says an exception missing any of the three fields, or past its expiry, fails the check.
• The text keeps "the ceiling" for the checked-in limit (Q513).
• .changes/toolchain/*.md with bump: minor and .changes/performance/*.md with bump: patch describe the change.
• The PR's CI is green.

Out of scope

• Deleting scripts/test-tmp-cleanup-baseline.txt and scripts/verb-contract-baseline.txt (builder work: a workflow names them).
• /review:fanout changes.

Related

• refactor(toolchain): move the ratchet skill from review to toolchain and delete three empty baselines #8543 deferred this work.

Parent: #7584