fix(security-tracker-stats): recognise the framework's own comment marker

[potiuk]

Summary

The default bot_prefixes does not list <!-- apache-magpie: — the canonical machine marker every framework skill writes on its status-rollup, hand-off and import comments. Those comments are therefore counted as human triage activity, pulling the time-to-triage median toward zero on any tracker the skills touch. The more the skills are used, the more wrong the metric gets.

Meanwhile the default does list <!-- airflow-s status rollup v — a marker specific to one adopter's tracker repo, meaningless to every other project. This swaps the leaked adopter marker for the framework's own.

Two things worth a reviewer's attention

1. Template-genericity residue. The airflow-s prefix is exactly what the upgrade flow's Step 6d audit exists to catch. #1123 removed the last apache-steward references; this one survived because it names an adopter, not the old framework.

2. The README's merge documentation was wrong, and that is what made this bug hard to notice downstream. It said the milestones and categories lists are replaced entirely — implying other lists merge. deep_merge replaces every list; its own docstring says "Lists are REPLACED, not concatenated." So an adopter who fixes the marker locally by overlaying one bot_prefixes entry silently discards all the defaults. Corrected to say every list replaces.

Test plan

• The config still parses under the hand-rolled _minimal_yaml_load subset parser with the added comments — checked directly, since that parser handles only a YAML subset and comments were a real risk.
• is_bot_body now classifies a real <!-- apache-magpie: status-rollup v3 --> comment as bot (True) while leaving a human triage comment alone (False).
• The tool's full suite passes: 114 tests, uv run --project . pytest.
• prek run --files passes on both files.

🤖 Generated with Claude Code