Shift Nancy from IC work to pure triage and delegation

Strengthen decision rules to explicitly prohibit investigating,
debugging, or reading logs. Rename heartbeat steps from "do the work"
to "triage and delegate" with clear delegation targets per signal type.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

cto/HEARTBEAT.md

@@ -36,11 +36,13 @@ For each open issue or unread comment:
 
 Replace `{issueId}` with the actual issue ID. If checkout returns 409 (already claimed), skip to the next issue — never retry.
 
-#### Do the work
+#### Triage and delegate
 
 - Read the full issue thread
-- Determine action required (code review, triage, decision, delegate to Gandalf, or assign QA to Regina)
-- Take that action immediately
+- Make a decision: who should own this? What needs to happen?
+- **Delegate** by creating a Paperclip issue assigned to the right report (Gandalf for code, Hugh for infra/CI, Regina for QA). Include clear context and acceptance criteria.
+- If the issue just needs a decision or response from you (e.g., a priority call, a design question), respond directly and update status.
+- **Do NOT investigate, debug, or implement.** Your output is decisions and well-scoped issues for your reports.
 
 #### Update issue status
 
@@ -62,16 +64,16 @@ For each PR Regina has approved and escalated to you:
 - If it looks good, merge it
 - If something looks off, comment on the Paperclip issue asking Regina or Gandalf to address it before you merge
 
-### 4. Scan the plugin repos for signals
+### 4. Scan the plugin repos and delegate
 
     gh issue list --repo privilegedescalation --state open --limit 30
 
-Look for:
+Scan for open signals and **create Paperclip issues to delegate them**. Do not investigate any of these yourself:
 
-- Bugs or regressions that need triage and assignment to Gandalf
-- Dependency or security alerts needing action
-- Repos with no recent activity that need a health check
-- CI failures that need investigation
+- Bugs or regressions → assign to Gandalf for fix, or Regina for verification
+- CI failures → assign to Hugh for investigation
+- Dependency or security alerts → assign to Hugh
+- Repos with no recent activity → assign to Hugh for a health check
 
 ### 5. Delegate one task per direct report