PR review worktree is cut from the PR's base branch, so reviewer instruction files (CLAUDE.md, AGENTS.md, skills/) come from that branch #463

Raised by the factory review of #461 (non-blocking, medium, security).

Since #461, review-pr / review-mr cut the review worktree from pr.baseRefName / mr.targetBranch (a 'base' start resolved through resolveRemoteBaseRef). The reviewer agent therefore reads CLAUDE.md, AGENTS.md and skills/ as that branch holds them. Copy-back protects CI config, not instruction files, so a PR whose base is any non-default branch — including one a prior Vanguard run pushed — can steer the reviewer that gates its own merge.

Before #461 the review worktree was cut from local main, which hid the problem rather than solving it (a PR against a release branch was reviewed with main's instructions).

Options to weigh:

• read the instruction files from the default branch regardless of the PR base, while still diffing against the real base;
• or restrict the factory review to PRs whose base is the default branch (the author gate already limits who can trigger it);
• or treat instruction files like CI config in copy-back and in the review prompt (diff-visible, never silently adopted).

Not for 1.4.0.