Merge pull request #3861 from hathach/claude/pr-babysit-hil-guard pr-babysit: never edit HIL rig configs without user approval