feat(skills): add governed reply router

[jdjioe5-cpu]

Summary

Adds skills/reply-router, a governed reply-routing skill for Frantic board task #70.

The skill routes inbound replies through explicit receipt and policy checks, appends unsubscribe suppressions through the data.source contract, and fails closed to human review when the reply is ambiguous or the original send receipt is not sealed.

Published package

• Public package: https://runx.ai/x/jdjioe5-cpu/reply-router
• Version: sha-b283aed72c5a
• Install command: runx add jdjioe5-cpu/reply-router@sha-b283aed72c5a --registry https://api.runx.ai

Verification

• runx-cli 0.6.14
• Local harness status: passed
• Harness cases: sealed_unsubscribe_suppression, stop_ambiguous_or_unsealed
• Assertion errors: 0
• Graph case count: 2
• Harness receipt: sha256:a21bde8ef82146536fea77aeedba6f0e62e29a727d5315e409abc8bfc0e74425

Raw review links

• X.yaml: https://raw.githubusercontent.com/jdjioe5-cpu/runx/26d8421ec5bd411a177e844313b80b67a3ef0c33/skills/reply-router/X.yaml
• SKILL.md: https://raw.githubusercontent.com/jdjioe5-cpu/runx/26d8421ec5bd411a177e844313b80b67a3ef0c33/skills/reply-router/SKILL.md

Notes

• The local data adapter is included under skills/reply-router/tools/data/local so the graph can exercise the same data.source contract expected from registry:runx/data-store@0.1.2 during harness runs.
• Runtime side effects generated by harness runs were excluded from the branch; only source, fixtures, and the summarized harness result are committed.

[jdjioe5-cpu]

Post-publish dogfood verification added:

• Installed package from remote registry: jdjioe5-cpu/reply-router@sha-b283aed72c5a
• Dogfood run: run_reply_route_6d7ab9539598
• Final status after explicit resume answer: sealed
• Root receipt: sha256:4d259d432da404774069a1bc920abdd4710818ad434d10abf580d88b84125132
• runx verify result: valid: true, signature_mode: production, receipt_count: 5, no findings

The first direct run correctly paused at needs_agent; resuming with an explicit classification answer completed the graph, appended the suppression event, and read back the updated projection.

[jdjioe5-cpu]

Final Frantic #70 delivery packet preflight now passes.

Artifact refs:

public_url=https://runx.ai/x/jdjioe5-cpu/reply-router@sha-b283aed72c5a
source_url=https://github.com/jdjioe5-cpu/runx/tree/26d8421ec5bd411a177e844313b80b67a3ef0c33/skills/reply-router
pr_url=https://github.com/runxhq/runx/pull/217
x_yaml=https://raw.githubusercontent.com/jdjioe5-cpu/runx/26d8421ec5bd411a177e844313b80b67a3ef0c33/skills/reply-router/X.yaml
skill_md=https://raw.githubusercontent.com/jdjioe5-cpu/runx/26d8421ec5bd411a177e844313b80b67a3ef0c33/skills/reply-router/SKILL.md
evidence_json=https://gist.githubusercontent.com/jdjioe5-cpu/446b8630d5f1efd9ee70b5efea433357/raw/712e74a864d31decae721e7938b07480051dfd8d/evidence.json
verification_json=https://gist.githubusercontent.com/jdjioe5-cpu/446b8630d5f1efd9ee70b5efea433357/raw/5b5b5eff2de5f83d845af8f1a0d736e339446299/verification.json
receipt_ref=runx:receipt:sha256:4d259d432da404774069a1bc920abdd4710818ad434d10abf580d88b84125132
report=https://gist.githubusercontent.com/jdjioe5-cpu/446b8630d5f1efd9ee70b5efea433357/raw/6d7871399ae701f9ba9fb03130a7db6df578fecd/report.md

Frantic /v1/deliveries/preflight returned ok: true with no errors or warnings for this packet.