[pfefferle]

Proposed changes:

• I compared the bug-bounty agent with the draft-pr skill in loop-pool and took over what fits this repo.
• The agent works in its own worktree with its own wp-env (ports 8890/8891). Before, it ran git checkout trunk in the main checkout, so a background run switched branches under whoever was working there.
• It posts nothing on issues anymore. A bug it can't confirm ends up in the report with a suggested label and comment.
• Before fixing, it reads the history: closed issues and PRs, git log -S on the changed lines, and tests that pin the current behavior. The fix has to keep the reason behind each earlier change.
• The regression test has to fail on trunk first.
• It runs the security-audit agent when the diff touches sensitive paths, and only opens a PR at 90% confidence or more.
• After CI, it checks Copilot's threads, fixes real bugs and suggests replies in the report instead of posting them.
• A final check makes sure CI and reviews ran on the head commit, trunk hasn't moved under the changed files, and the PR text still matches the code.

Issue selection, CI polling, the PHP 7.4 note and the WordPress hook rules are unchanged.

Other information:

• Have you written new tests for your changes, if applicable?

Testing instructions:

• Run the agent: "use the bug-bounty agent".
• It creates ../wordpress-activitypub-<name> and leaves the main checkout on its current branch.
• No label or comment shows up on issues it skips.
• The report ends with verdict, PR, history, Copilot and the items for the maintainer.

Changelog entry

• Automatically create a changelog entry from the details below.