Follow-up to #100: fix CodeQL finding, externalize the bridge marker

[open-coder-ai]

What

Two small loose ends discovered right after #100 merged (spine-a W48, "externalize, don't
hardcode" wave), both fixed here:

1. CodeQL finding on Externalize emitted-artifact templates and the CLI command table into data files #100 (code-scanning alert #121):
   _GITATTRIBUTES_TEMPLATE in scaffold/templates.py flagged as an unused global. It is not
   unused — it's genuinely consumed from scaffold/init.py — but its leading underscore reads as
   module-private while its two siblings in the same file (POLICIES_GUARDRAIL,
   SKILLS_GUARDRAIL) already have no underscore for the identical cross-module usage. Renamed
   to GITATTRIBUTES_TEMPLATE to match and resolve the finding at its root cause.

2. A missed template: scaffold/skills_bridge.py's _BRIDGE_MARKER_BODY (the ownership-note
   text written into a bridge directory) is exactly the same kind of emitted, non-Python
   (plain-text) artifact template as everything Externalize emitted-artifact templates and the CLI command table into data files #100 moved, but wasn't in that wave's inventory.
   Externalized to scaffold/data/bridge_marker.txt, read via package_data_dir — the same
   pattern already used for its sibling templates in the same package. Content verified
   byte-identical directly.

Both files are already covered by the existing "chock.scaffold" = ["data/*"] package-data
glob (no pyproject.toml change needed). tests/test_template_tokens.py extended to cover the
marker alongside the other static (token-free) templates.

Verification

• Byte-identical, verified directly: skills_bridge._BRIDGE_MARKER_BODY after the change equals
  the original literal string.
• pytest -q → 1047 passed, 1 skipped (pre-existing, unrelated).
• chock check → exit 0; chock sync --repo . --check → compiled artifacts match manifests.
• ruff check . and ruff format --check . clean.
• Wheel build: chock/scaffold/data/bridge_marker.txt confirmed present in the built wheel.

Definition of done

• chock check → 0 errors, 0 warnings, 0 infos
• chock sync --repo . --check clean
• pytest -q green
• ruff check . and ruff format --check . clean
• No version bump (byte-identical, cosmetic/organizational change only)

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 903ed571-fbb9-46f8-93da-cd66bfac5ffc

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}