Clarify and enforce reviewer-vs-merger role boundaries (#483)

skills/llm-project-workflow/templates/merge-pr.md

@@ -1,4 +1,4 @@
-# Template: merge a PR (eligible reviewer only)
+# Template: merge a PR (eligible merger only)
 
 Copy, fill the `<...>` fields, and paste as the task prompt.
 
@@ -10,8 +10,9 @@ Load the canonical workflow first:
 Final report schema: `schemas/review-merge-final-report.md`.
 
 Rules (llm-project-workflow):
-- Only an eligible, NON-author reviewer merges. If authenticated user == PR
+- Only an eligible, NON-author merger merges. If authenticated user == PR
   author → STOP.
+- Review and merge are separate workflow roles. A reviewer approval is not merge authorization.
 - Do not merge unless the PR is open, mergeable, and its checks/review pass.
 - No force-merge, no bypassing branch protections.
 - If the PR is closed but `merged=false`, STOP and run reconciliation. Do not clean up.
@@ -51,10 +52,12 @@ Then run the cleanup template (worktree-cleanup.md):
 - fetch/prune; confirm main checkout is clean and current (0 0).
 
 Handoff: end with a section titled exactly `Controller Handoff` per SKILL.md
-§K (long form — a merge is always high-risk), including the review/merge role
-fields (Selected PR, Reviewer eligibility, Pinned reviewed head, Review
+§K (long form — a merge is always high-risk), including the merger role
+fields (Selected PR, Merger eligibility, Pinned reviewed head, Review
 decision, Merge result, Linked issue status, Cleanup status) plus: merge
 commit, PR metadata state/merged flag/hash, remote master hash, and the
 post-merge verification method used & verification results. Reports missing
 the handoff are downgraded (review_proofs.assess_controller_handoff).
+
+Review and merge are separate workflow roles. A reviewer approval is not merge authorization.
 ```