fix(push-gate): handle cwd when invoked from github-ops

Add optional --cwd <repo-root> flag to preflight.sh. When present, the
script cd's to that path before any git commands run — fixing the bug
where github-ops invokes the script from a different working directory
and git operates on the wrong repo.

Flag must precede the positional <remote> <branch> args; omitting it
preserves existing $PWD behaviour, so no existing callers break.

Updated push-gate/SKILL.md Invocation section and both push-gate call
sites in github-ops/SKILL.md to pass --cwd <repo>.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

skills/github-ops/SKILL.md

@@ -71,7 +71,7 @@ Triggered by: "publish to github", "create repo on github", "push to github" (wh
    (NEVER pass --push; we want push-gate to run between)
 
 5. Run push-gate preflight:
-   bash $HOME/.claude/skills/push-gate/scripts/preflight.sh origin main
+   bash $HOME/.claude/skills/push-gate/scripts/preflight.sh --cwd <repo> origin main
    On any non-zero exit: stop, report, do not push.
 
 6. Push main + tags:
@@ -126,7 +126,9 @@ Triggered by: "ship a release", "cut a release", "release v0.X.Y", "publish upda
 6. Create local tag via git-ops:
    git tag -a v<N> -m "v<N>"
 
-7. Run push-gate preflight on origin <branch>.
+7. Run push-gate preflight:
+   bash $HOME/.claude/skills/push-gate/scripts/preflight.sh --cwd <repo> origin <branch>
+   On any non-zero exit: stop, report, do not push.
 
 8. Push commits + tag:
    git push origin <branch>

skills/push-gate/SKILL.md

@@ -42,9 +42,15 @@ Step 11 →  Post-push verify (ls-remote matches pushed SHA)
 ## Invocation
 
 ```bash
+# From the repo root (most common)
 bash .claude/skills/push-gate/scripts/preflight.sh <remote> <branch>
+
+# When calling from another skill with a different cwd (e.g. github-ops)
+bash $HOME/.claude/skills/push-gate/scripts/preflight.sh --cwd <repo-root> <remote> <branch>
 ```
 
+`--cwd` must precede the positional arguments. When omitted, the script operates against `$PWD`.
+
 The script prints a structured report and exits with:
 
 | Exit code | Meaning | What Claude does |

skills/push-gate/scripts/preflight.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # preflight.sh — Full pre-push gate orchestration.
 #
-# Usage:   preflight.sh <remote> <branch>
+# Usage:   preflight.sh [--cwd <repo-root>] <remote> <branch>
 # Exit codes:
 #   0  all gates passed; ready to push
 #   1  secret hit (gitleaks or regex)
@@ -13,16 +13,27 @@
 
 set -euo pipefail
 
+# Optional --cwd <path> must come before positional args
+REPO_ROOT=""
+if [ "${1:-}" = "--cwd" ]; then
+  REPO_ROOT="${2:?"push-gate: --cwd requires a path argument"}"
+  shift 2
+fi
+
 REMOTE="${1:-}"
 BRANCH="${2:-}"
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 if [ -z "$REMOTE" ] || [ -z "$BRANCH" ]; then
-  echo "push-gate: usage: preflight.sh <remote> <branch>" >&2
+  echo "push-gate: usage: preflight.sh [--cwd <repo-root>] <remote> <branch>" >&2
   exit 6
 fi
 
+if [ -n "$REPO_ROOT" ]; then
+  cd "$REPO_ROOT"
+fi
+
 divider() { printf '%.0s─' $(seq 1 63); echo; }
 
 echo "push-gate preflight :: target = ${REMOTE}/${BRANCH}"