Harden Puber workflow user-action gates

.kent/commands/ship-pr.md

@@ -28,8 +28,9 @@ Desktop workflows.
    git branch --show-current
    git remote -v
    ```
-3. If there are no repository changes and the task was report-only or smoke-only, report PR as not applicable and finish.
-   Do not create empty commits or empty PRs.
+3. If there are no repository changes and the task was report-only or smoke-only, report PR as not applicable and use the
+   workflow's `no_pr` transition. Do not create empty commits or empty PRs. `no_pr` is approval-gated because it allows
+   cleanup without a merged PR.
 4. If there are changes:
    - Verify the current branch is a task/worktree branch, not `master`/`main`.
    - Stage only task-related files.
@@ -54,7 +55,8 @@ Desktop workflows.
 Complete with:
 
 - `monitor_ci` when a PR exists and CI should be monitored. Provide `pr_url`, `branch_name`, and `workspace_path`.
-- `no_pr` only when PR is intentionally not applicable because there are no repository changes. Provide `pr_report`.
+- `no_pr` only when PR is intentionally not applicable because there are no repository changes. Provide `pr_report`; the
+  workflow must stop for user approval before cleanup.
 - `needs_changes` when task-scoped PR/branch issues can be fixed safely. Provide `workspace_path` and
   `blocker_reason`.
 - `needs_user_action` when PR creation/update cannot be completed safely without user input, credentials, or a policy

.kent/project-contract.md

@@ -86,7 +86,7 @@ worktree metadata until Kent rebind behavior is fixed.
 
 - `cleanup_managed_task_worktrees`: `false` by default.
 - Code-producing workflow cleanup must happen after `waiting_pr` confirms the PR is merged through GitHub state, or after
-  an explicit no-diff/report-only `pr_report`.
+  the user approves an explicit no-diff/report-only `pr_report` through the `no_pr` transition.
 - Release cleanup must happen after tag publication is monitored, or after explicit user cancellation.
 - Cleanup after a PR path must verify `gh pr view --json state,mergedAt,mergeCommit,headRefName,baseRefName,url` when
   GitHub CLI is available. Do not rely only on git ancestry because squash merges are allowed.
@@ -104,6 +104,8 @@ Recoverable blockers must not use a terminal node. The workflow keeps the task i
 - `needs_changes`: audit/review/compliance/CI/PR feedback needs task-scoped fixes. Internal fix loops should not require
   approval; `ship_pr -> needs_changes` stays approval-gated because branch recovery can involve rebase or force-push
   policy.
+- `no_pr`: the task has no repository changes or is explicitly report-only. This transition is approval-gated because it
+  allows cleanup/done without a merged PR.
 
 Terminal `wont_do` is only for explicit user cancellation or "not planned" decisions and requires approval. It is not a
 recoverable blocker.
@@ -122,6 +124,8 @@ recoverable blocker.
 - Release workflows route `waiting_pr -> pr_merged -> publish` with human approval before tag publication.
 - `close_without_merge` is approval-gated and valid only when the latest user comment explicitly says to close, cancel, or
   skip the PR.
+- `no_pr` is approval-gated and valid only when the PR step produced a clear `pr_report` explaining why no PR is
+  applicable.
 
 ## Release Policy
 

.kent/workflows/README.md

@@ -55,11 +55,12 @@ Legacy split release workflows (`Puber Release Preparation` and `Puber Release P
   replacement for audit/review/verify/smoke; it only checks adherence to AGENTS.md, project contracts, specs, plans,
   human-approved design decisions, and workflow transition contracts.
 - Code-producing workflows must create or update a PR after compliance passes. `ship_pr` may skip PR only for explicit
-  no-diff/report-only/smoke-only cases and must explain that through `pr_report`.
+  no-diff/report-only/smoke-only cases and must explain that through `pr_report`. That `no_pr` path must require user
+  approval before cleanup because it finishes without a merged PR.
 - `ci_monitor` never merges PRs and never pushes new commits. CI failures go back to fix/review/compliance before another
   PR/CI pass.
 - `done` is terminal and must mean delivered: PR merged and cleanup completed, release published and cleanup completed,
-  explicit no-diff/report-only cleanup completed, or explicit `wont_do`.
+  user-approved no-diff/report-only cleanup completed, or explicit `wont_do`.
 - `waiting_pr` is the normal post-CI state for PR workflows. It may only advance to cleanup after GitHub reports
   `state=MERGED`, or to release publication after the release PR is merged and the publish transition is approved.
 - `wont_do` is terminal and approval-gated. Use it only for explicit user cancellation or "not planned"; do not use it as