refactor(root): move iyarc-prune prompt to shared .claude/agents subagent

Ticket: HSM-429

Author: rashadjnizar

.github/prompts/iyarc-prune.md .claude/agents/iyarc-prune.md.github/prompts/iyarc-prune.md renamed to .claude/agents/iyarc-prune.md

@@ -1,10 +1,16 @@
-You are an automated maintenance agent for the BitGoJS monorepo, run on a
-schedule by GitHub Actions. BitGoJS is the client SDK that BitGo and external
-clients install directly into their applications (wallets, signing, transaction
-building). As a security posture, BitGo does not release packages with known
-vulnerabilities. The release pipeline runs an `improved-yarn-audit` gate;
-advisories that do not actually apply to us are suppressed in the `.iyarc`
-ignore file at the repo root, each with a justification comment.
+---
+name: iyarc-prune
+description: Prunes stale improved-yarn-audit exclusions from .iyarc. For each GHSA exclusion, checks whether an upstream fix shipped, bumps the dep (usually a root resolutions pin), removes the exclusion, and proves it against the release gates (audit-high + check-deps + scoped build/test) before opening an assigned PR. Use for periodic .iyarc maintenance, in CI or locally.
+---
+
+You are the iyarc-prune maintenance agent for the BitGoJS monorepo. You are
+usually run on a schedule by GitHub Actions, but a developer may also invoke you
+locally. BitGoJS is the client SDK that BitGo and external clients install
+directly into their applications (wallets, signing, transaction building). As a
+security posture, BitGo does not release packages with known vulnerabilities. The
+release pipeline runs an `improved-yarn-audit` gate; advisories that do not
+actually apply to us are suppressed in the `.iyarc` ignore file at the repo root,
+each with a justification comment.
 
 Over time `.iyarc` accumulates exclusions that are no longer needed because
 upstream shipped a fix. Nobody prunes them, so the suppressed audit surface
@@ -100,6 +106,17 @@ order:
 ## Commit and pull request (only if at least one exclusion was removed with a
 fully green feedback loop)
 
+How you finish depends on where you are running:
+
+- **If running in CI** (a `iyarc-prune/*` branch exists and the
+  `mcp__github_file_ops__commit_files` tool is available): commit and open the PR
+  as described below.
+- **If a developer is running you locally:** make the edits, run the full
+  feedback loop, print the summary table and the "Still blocked" section, and
+  STOP. Do not commit or open a PR — let the developer review and commit.
+
+CI commit/PR rules:
+
 - Commit message: conventional (commitlint extends `@commitlint/config-conventional`;
   `deps` and `root` are valid scopes), e.g.:
   `chore(deps): bump <pkg> to <version>, drop <GHSA> from .iyarc`.

.github/workflows/iyarc-prune.yml

@@ -58,19 +58,19 @@ jobs:
           echo "::add-mask::$AWS_SECRET_ACCESS_KEY"
           { echo "aws-access-key-id=$AWS_ACCESS_KEY_ID"; echo "aws-secret-access-key=$AWS_SECRET_ACCESS_KEY"; echo "aws-session-token=$AWS_SESSION_TOKEN"; } >> "$GITHUB_OUTPUT"
 
-      - name: Read prune prompt
-        id: read-prompt
+      - name: Load iyarc-prune agent instructions
+        id: agent
         run: |
           {
-            echo "prompt<<IYARC_PRUNE_EOF"
-            cat .github/prompts/iyarc-prune.md
+            echo "content<<IYARC_PRUNE_EOF"
+            sed '1,/^---$/d' .claude/agents/iyarc-prune.md
             echo "IYARC_PRUNE_EOF"
           } >> "$GITHUB_OUTPUT"
 
       - name: Run Claude Code (Bedrock)
         uses: anthropics/claude-code-action@v1
         with:
-          prompt: ${{ steps.read-prompt.outputs.prompt }}
+          prompt: ${{ steps.agent.outputs.content }}
           use_commit_signing: 'true'
           branch_prefix: 'iyarc-prune/'
           claude_args: --allowed-tools 'Edit,MultiEdit,Write,Read,Glob,Grep,LS,Bash,mcp__github_file_ops__commit_files,mcp__github_file_ops__delete_files'

.gitignore

@@ -18,5 +18,8 @@ modules/**/dist/
 modules/**/pack-scoped/
 coverage
 /.direnv/
-.claude/
+.claude/*
+!.claude/agents/
+.claude/agents/*
+!.claude/agents/*.md
 .cursor/