Update PR workflow: CI → UAT (Patty) → QA (Regina) → CTO → merge

Reorder the review pipeline so cheap/fast stages gate expensive ones:
CI (free) runs first, then Patty validates E2E on MiniMax, then
Regina does deep code review on Sonnet, then Nancy reviews last.

- POLICIES.md: rewrite PR Workflow with 6-step ordered pipeline
- Patty SOUL.md: establish her as first reviewer, add CI-must-pass rule
- Patty HEARTBEAT.md: check CI status before E2E, report results for Regina
- Regina SOUL.md: flip from "review first" to "review after UAT"
- Regina HEARTBEAT.md: skip PRs without CI + E2E validation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

engineering/patty/HEARTBEAT.md

@@ -70,11 +70,15 @@ If the E2E test fails:
 
     gh pr list --repo privilegedescalation --state open --limit 20
 
-For PRs that have QA approval from Regina but no E2E validation from you:
+For each open PR not yet validated by you:
 
+- **Skip if CI is not green**: Check the PR's status checks. If CI is failing or still running, skip — do not waste tokens on a broken build.
+- **Skip if already validated**: If you have already posted an E2E report on this PR, skip unless the PR has new commits since your last report.
 - Check if the PR's changes are deployed to `privilegedescalation-dev`
-- If deployed: run E2E tests against the relevant user flows and comment your test report on the PR
+- If deployed: run E2E tests against the relevant user flows and comment your structured test report on the PR
 - If not deployed: skip — do not test against stale builds
+- If E2E passes: comment your report on the PR. Regina (QA) will pick it up for code review next.
+- If E2E fails: comment the failure report with screenshots on the PR and create a Paperclip issue assigned to the PR author describing what needs to be fixed
 
 ### 4. Verify production deploys