Add cherry-pick-after-merge ask-first rule to HEARTBEAT.md

Atomic single edit to HEARTBEAT.md Step 4 (Git & work), queued from 2026-06-11 04:35Z self-reflection. Codifies the lesson from the BOLT-1211 PR #11886 → #11888 cherry-pick → silent-close arc. CONTEXT: 2026-06-08T13:38Z Cursor Bugbot Medium finding on Slava-authored PR #11886 (BOLT-1211 SFTP staleness on failed polls). Slava merged #11886 at 13:41Z, ~5 minutes before sub-agent fix push could land. Sub-agent then cherry-picked the fix onto a new cato/bolt-1211-staleness-on-failed-polls branch and opened follow-up PR #11888 at 13:46Z. PR #11888 sat ~38h. 06-10T05:39Z first-nudge DM in the BOLT-1211 thread. 06-10T06:15Z Slava CLOSED #11888 without comment, without merge. The follow-up PR was unwanted; the work was wasted. DOCTRINE TO ADD (HEARTBEAT.md Step 4 / Git & work, adjacent to the parallel-fix-check section): ``` ### Cherry-pick-after-merge: ask first, do not open the follow-up PR automatically If a Cursor / CodeRabbit / human reviewer finding fires on a Slava-authored PR that has ALREADY MERGED (you missed the merge window by seconds-to-minutes, or the finding fires on a post-merge re-analysis), DO NOT: - automatically cherry-pick the fix onto a new cato/* branch; - automatically open a follow-up PR; - treat the follow-up PR as obviously wanted. Instead: 1. Queue a fleet-task with the finding text, the merged PR URL, the proposed fix, and the branch you would create. 2. Reply in-thread to the existing PR thread: `Cursor flagged <finding> on the now-merged PR. Want me to follow up as a separate PR, or drop it?` 3. Wait for explicit go-ahead before opening anything. If no reply within 24h, drop the follow-up and PATCH the fleet-task to completed with `no go-ahead received; dropped`. 4. If go-ahead arrives, open the cato/* branch and PR per the normal flow. Case study (2026-06-08 → 06-10 PR #11886 → #11888): Cursor finding fired on PR #11886 at 13:38Z; Slava merged at 13:41Z; sub-agent cherry-picked to PR #11888 at 13:46Z. PR sat 38h. First-nudge DM at 06-10T05:39Z (`Want me to merge, hold, or rework?`). Slava closed without comment at 06-10T06:15Z, 36 minutes after the nudge. The follow-up was unwanted. The 5-second ask-first DM would have produced a `drop it` reply before any branch creation or sub-agent dispatch. Exception: if the finding is HIGH severity (data corruption, security, production-down risk), open the follow-up PR without asking — the cost of waiting for explicit go-ahead is higher than the cost of an unwanted PR. Medium and Low findings on merged PRs require the ask-first rule. ``` DELIVERY: workspace-internal write to ~/agents/slava-agent/HEARTBEAT.md. No PR. After the edit, PATCH this fleet-task to completed via bin/fleet-task-patch.sh with a short result citing the case study and the file:line of the inserted section.