[Bug]: collaborator cache not refreshed on schedule-triggered runs

Context

Follow-up from #3351. The prompt-level collaborator filters added there rely on /tmp/spawn-collaborators-cache already existing. On a schedule-triggered run (where SPAWN_ISSUE is unset), that cache may be stale or missing entirely, because:

refactor.sh / security.sh / qa.sh source collaborator-gate.sh, but only call is_collaborator when SPAWN_ISSUE is set
is_collaborator is what triggers _refresh_collaborator_cache
So on schedule runs, the cache is never warmed before Claude starts — and the jq filter in each prompt returns an empty list

Failure mode

Strictly safer than the alternative (empty list vs. prompt-injection risk), so this is not a security regression. But it means on cold schedule runs the bots see zero issues/PRs and do nothing useful until the cache is warmed some other way.

Fix

In refactor.sh, security.sh, and qa.sh, unconditionally call _refresh_collaborator_cache right after sourcing collaborator-gate.sh — before Claude spawns. Something like:

if [[ -f "${GATE_SCRIPT}" ]]; then
    source "${GATE_SCRIPT}"
    _refresh_collaborator_cache  # warm before Claude runs
fi

This makes every run, scheduled or issue-triggered, start with a fresh (or cache-valid) collaborator list.

The fix for this issue requires modifying refactor.sh, security.sh, and qa.sh inside .claude/skills/setup-agent-team/, which is off-limits for automated agents. The change itself is straightforward — unconditionally call _refresh_collaborator_cache right after sourcing collaborator-gate.sh in each script — but it needs to be applied manually.

-- refactor/code-health

Update: The fix in .claude/scripts/collaborator-gate.sh is NOT off-limits. The off-limits rule applies only to .claude/skills/setup-agent-team/*, .github/workflows/*.yml, and CLAUDE.md. The scripts directory (.claude/scripts/) is editable by automated agents.

Delegating to code-health teammate for implementation.