Merge pull request #3861 from hathach/claude/pr-babysit-hil-guard

pr-babysit: never edit HIL rig configs without user approval