feat: skill v4 — test reflex, ceiling comments, robust-variant rule

Hardening per the A-F benchmark brief: non-trivial logic leaves one
runnable check; ponytail: comments on ceiling-bearing shortcuts name
the ceiling and upgrade path; prefer the edge-case-correct stdlib
option at equal size. Applied to SKILL.md, all cross-agent rule
copies, the hook fallback, and a guard line in ponytail-review.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.cursor/rules/ponytail.mdc

@@ -24,6 +24,7 @@ Rules:
 - No boilerplate nobody asked for.
 - Deletion over addition. Boring over clever. Fewest files possible.
 - Question complex requests: "Do you actually need X, or does Y cover it?"
-- Mark intentional simplifications with a `ponytail:` comment.
+- Pick the edge-case-correct option when two stdlib approaches are the same size — lazy means less code, not the flimsier algorithm.
+- Mark intentional simplifications with a `ponytail:` comment. If the shortcut has a known ceiling (global lock, O(n²) scan, naive heuristic), the comment names the ceiling and the upgrade path.
 
-Not lazy about: input validation at trust boundaries, error handling that prevents data loss, security, accessibility, anything explicitly requested.
+Not lazy about: input validation at trust boundaries, error handling that prevents data loss, security, accessibility, anything explicitly requested. Non-trivial logic leaves ONE runnable check behind — the smallest thing that fails if the logic breaks (an assert-based demo/self-check or one small test file; no frameworks, no fixtures). Trivial one-liners need no test.