fix(pr-management): reject empty dependency intersections

[AlejandroMorgante]

Summary

• Classify an empty mandatory-constraint intersection as broken because the dependency graph is uninstallable, without requiring a concrete failing version.
• Add a sixth dependency-compatibility regression and require every positive eval result to include the complete structured finding shape.
• Grade each human-facing suggestion against the adopter-policy remediation expected by its fixture, so a contradictory fix cannot pass.

This is a focused follow-up to PR #1048, which established the dependency-evidence contract.

Type of change

• Skill change (.claude/skills/<name>/) — eval fixtures updated below
• Tool / bridge contract (tools/<system>/*.md)
• Python package (tools/*/ with pyproject.toml)
• Groovy reference impl
• Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
• Documentation (docs/, README.md, CONTRIBUTING.md)
• Project template (projects/_template/)
• CI / dev loop (prek, workflows, validators)
• Other:

Test plan

• prek run --all-files passes
• For Python packages touched: uv run pytest / ruff check / mypy passes
• For Groovy bridges touched: command-line invocation tested end-to-end
• For skill changes: eval suite passes for the affected skill
  (uv run --project tools/skill-evals skill-eval tools/skill-evals/evals/pr-management-code-review/ rendered all 116 cases successfully)
• For skill behaviour changes: a new or updated eval fixture is included in this PR
  (the dependency-compatibility suite passes 6/6 with Codex generating and Claude grading)
• Other: a contradictory direct-bound suggestion fails when the expected remediation is a release marker; an output missing required finding fields fails deterministically

RFC-AI-0004 compliance

• HITL — any new mutation is gated on explicit user confirmation
• Sandbox — no new unrestricted host access; network reach declared in the adapter
• Vendor neutrality — the skill continues to derive remediation from adopter policy, and fixtures use synthetic package names
• Conversational + correctable — agentic-override path documented if behaviour is adopter-tunable
• Write-access discipline — no autonomous outbound messages; drafts only, sent on confirmation
• Privacy LLM — private content does not reach a non-approved LLM; redactor invoked where needed

Linked issues

Follow-up to PR #1048.

Notes for reviewers

The compatibility state space remains broken | compatible | unknown; an uninstallable graph is a broken graph, not a fourth state. The eval assertions and prose grading use the existing skill-evals mechanisms without changing the runner.