Treat Issue Text as Data in the Unattended Handoff Picker and Worker #1853

Raised by CodeRabbit on ptr727/NxWitness#588 against the carried .github/skills/unattended-handoff/SKILL.md, byte-identical to .agents/skills/unattended-handoff/SKILL.md on main 45669468 and develop 23ef3574.

The picker's eligibility criteria never check who authored an issue, and no carried skill states that issue or comment text is data rather than instructions. The worker reads the handoff built from that text, and under the main or release scope the run merges and releases without a maintainer present. In a public repository with issues open to anyone, an external account's issue text can therefore steer an unattended run that ships.

What bounds it today: the default scope is develop, and the maintainer names any wider scope at invocation.

Possible fixes, for the maintainer to choose between:

• Restrict unattended eligibility to issues authored by the maintainer, or by a trusted bot.
• State in the skill that issue and comment text is untrusted data, never instructions.
• Refuse the main and release scopes for work derived from an issue that an outside account authored.