fix: n/a icon, attachment links, literal block-tag escaping, qa-gather discovery

- Replace the `(-)` token with `(off)` for "not applicable" findings:
  `(-)` renders as a red forbidden icon in Jira and reads as a failure,
  while the lines it prefixes list intentionally skipped checks. `(off)`
  renders as a subtle grey switched-off lamp. Aligns comment-template.md
  examples with the severity.md warning (they contradicted each other).
- Sanity scan: add check for unescaped block-markup tags ({code},
  {noformat}, {quote}, {panel}) in prose - block tags are never inline;
  literal mentions must be escaped as \{code\}.
- Sanity scan: add check that referenced attachments are linked with
  [^filename] instead of bare filenames.
- qa-gather.sh: also match jira-qa-gather.py - jira-integration >= 3.13
  ships the script under that name, so discovery silently fell back to
  multi-call mode on current installs.

Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>

Author: CybotTM

skills/peer-qa-review/references/comment-template.md

@@ -99,7 +99,7 @@ h4. Inventory / linked artefacts
 
 h4. Guardrails
 (/) G1: adjacent components {A}, {B} spot-checked, unchanged
-(-) G2: n/a — not a shared-layer change
+(off) G2: n/a — not a shared-layer change
 (/) G3: default-path of {flag/config} still behaves as before
 
 h4. Documentation
@@ -111,7 +111,7 @@ h4. Rollback / backout
 (/) Backout path documented: {how}
 
 h4. Communication
-(-) n/a — internal-only change   |   (/) Announced in {channel}   |   (!) Customer-affecting; no announcement found
+(off) n/a — internal-only change   |   (/) Announced in {channel}   |   (!) Customer-affecting; no announcement found
 
 h4. Process compliance
 (/) Comments in {code} blocks throughout
@@ -128,7 +128,7 @@ Ready to {transition-name-from-your-system}.
 
 The **verdict line** must match your ticket system's actual transition name *and* the routing rule. For example, in a system where "QA passed" transitions to a customer-acceptance status, do not write "Ready to transition to QA passed" if the verdict is "internal-resolve" — that's a contradiction. Use the literal transition name that matches the routing decision (e.g. "Resolve" for internal-resolve, "QA passed" only when the next stop really is customer acceptance).
 
-Keep it tight. Skip pillars that don't apply (e.g. omit "Communication" if `(-)` n/a). Don't pad with `(/)` for every check — list `(/)` items only when they're load-bearing or non-obvious.
+Keep it tight. Skip pillars that don't apply (e.g. omit "Communication" if `(off)` n/a). Don't pad with `(/)` for every check — list `(/)` items only when they're load-bearing or non-obvious.
 
 ## Sanity scan before posting
 
@@ -140,6 +140,8 @@ Re-read your own comment before clicking *Add*. Common self-introduced bugs:
 4. **Transition-name vs verdict mismatch** — the verdict's *meaning* and the *literal transition name* must agree (see above).
 5. **Pillar P claims vs actual content** — if your P-pillar says "comments use `{code}` blocks" while your comment uses `{{monospace}}` for commands, that's the very contradiction the runbook is meant to prevent.
 6. **Link audit on your own references** — every issue key, MR/PR, commit, or external URL you introduce must also exist as a structural link (issue link or web link), not just inline. See F4a (reviewer-side). *Anti-pattern:* "filed as NEW-TICKET" without the link.
+7. **Unescaped block-markup tags in prose** — writing *about* `{code}` (or `{noformat}`, `{quote}`, `{panel}`) opens a real block right there in the rendered comment and swallows the rest of the line. These tags are block markup; any inline occurrence in prose is a smell. Escape as `\{code\}` when you mean the literal tag.
+8. **Attachment mentioned but not linked** — when your comment references an attached file (session log, screenshot, report), link it with `[^filename.log]` so the reader gets a one-click open. A bare filename forces a scroll-and-hunt through the attachment list.
 
 ## Example 1 — Pass (NRS-4365 shape)
 
@@ -170,8 +172,8 @@ h4. Inventory / linked artefacts
 
 h4. Guardrails
 (/) G1: vault role's two adjacent callers (consul, exocortex bootstrap) spot-checked, unchanged
-(-) G2: n/a — not a shared-layer change
-(-) G3: n/a — no config defaults touched
+(off) G2: n/a — not a shared-layer change
+(off) G3: n/a — no config defaults touched
 
 h4. Documentation
 (!) README "Currently supported platforms" still says Debian 12 only
@@ -181,7 +183,7 @@ h4. Rollback / backout
 (/) Single-line template change; rollback = revert tag bump in requirements.yml + re-run ansible. Documented implicitly via git history.
 
 h4. Communication
-(-) n/a — internal-only change to internal infrastructure
+(off) n/a — internal-only change to internal infrastructure
 
 h4. Process compliance
 (/) Comments in {code} blocks throughout

skills/peer-qa-review/references/severity.md

@@ -11,11 +11,11 @@ Reuse the standard Atlassian / Jira-wiki icon set. Do **not** invent new categor
 | `(!)` | `(!)` | **SHOULD**: real issue, non-blocking *for this ticket* | document; create follow-up if structural |
 | `(i)` | `(i)` | **HINT**: improvement suggestion / next-time nice-to-have | document; no action required |
 | `(?)` | `(?)` | open question for implementer | block on answer |
-| `(-)` | *literal text* `n/a` | not applicable here | none — explicit "we considered this and it doesn't apply" |
+| `(off)` | `(off)` | not applicable here | none — explicit "we considered this and it doesn't apply" |
 
 In rendered Jira these become coloured icons. In other systems (GitHub, GitLab, Markdown), use the literal strings — they read clearly even unrendered.
 
-**Watch out for `(-)` specifically**: in Jira wiki the `(-)` token renders as a *forbidden* / *no-entry* icon (🚫), not as "n/a". The forbidden icon visually says "blocked / denied", which is wrong for "not applicable here". Use **literal text** like `*n/a*` or write *"n/a — reason"* instead of the `(-)` token in Jira comments. The other tokens (`(/) (x) (!) (i) (?)`) render with semantically-correct icons.
+**Never use `(-)` for "n/a"**: in Jira wiki the `(-)` token renders as a *red* forbidden / no-entry icon, which visually screams "error / blocked / denied" — readers scan it as a failure even though the line lists something that was *considered and intentionally skipped*. Use `(off)` instead: it renders as a subtle grey switched-off lamp, which reads as "nothing active here" without alarm colour. The other tokens (`(/) (x) (!) (i) (?)`) render with semantically-correct icons.
 
 Also avoid using `(/)`, `(x)`, `(!)`, `(i)`, `(?)` literally in *prose* when you mean to *refer to* a finding by its severity. Jira will render the icon mid-sentence, which is visually confusing. Write "the SHOULD-fix finding" or "the warning above" instead of "the `(!)`".
 
@@ -57,9 +57,9 @@ If you can't decide between `(!)` and `(i)`: ask whether the issue would still b
 
 > *(?) Was the OPNsense config snapshot taken before the major upgrade? I see the patch-update comment but not a snapshot mention.*
 
-### `(-)` — n/a
+### `(off)` — n/a
 
-> *(-) Communication (C1–C3): change is internal-only (CI image refresh), no announcement needed.*
+> *(off) Communication (C1–C3): change is internal-only (CI image refresh), no announcement needed.*
 
 ## Anti-patterns in severity choice
 

skills/peer-qa-review/scripts/qa-gather.sh

@@ -35,7 +35,7 @@ find_qa_gather() {
     for p in "${search_paths[@]}"; do
         [[ -z "$p" ]] && continue
         local found
-        found=$(find "$p" -maxdepth 6 -path '*/skills/jira-communication/scripts/utility/qa-gather.py' 2>/dev/null | head -n1)
+        found=$(find "$p" -maxdepth 6 \( -path '*/skills/jira-communication/scripts/utility/jira-qa-gather.py' -o -path '*/skills/jira-communication/scripts/utility/qa-gather.py' \) 2>/dev/null | head -n1)
         if [[ -n "$found" ]]; then
             echo "$found"
             return 0