claude.yml auto-commit sweep commits setup-r-dependencies' .github/pkg.lock #983

claude.yml (v2) ends with an auto-commit sweep that commits anything left in git status --porcelain (around line 989). In an R/Quarto consumer, the setup steps leave .github/pkg.lock untracked. That file is the lockfile r-lib/actions/setup-r-dependencies writes. So an @claude review mention on a PR pushes a large generated lockfile onto the PR branch.

Measured 2026-09-28 on two PRs:

• Drop the no-new-extensions rule and the stale submodule premise mds#32: commit d5118a3 added a 15,268-line .github/pkg.lock.
• Drop the no-new-extensions rule and the stale submodule premise sds#19: commit de39d67 added an 18,760-line one.

Both commits were titled "chore: auto-commit residual @claude session changes". In each repo, the next automated review then flagged the lockfile as out of scope.

Fix: exclude known setup artifacts from the sweep (at least .github/pkg.lock, and .github/r-depends.rds if written), or remove them before git status. Excluding them can't lose Claude's work, because the agent never writes these files.