feat(workflow): defer ci-pending label until accepted is added

[BYK]

Summary

Issues now stay label-free on open. Labels only appear once someone adds accepted to approve the release. Also fixes an auto-approve race condition that could publish without CI verification.

UX problem (user-reported)

Users got confused when issues sat in ci-pending forever without any feedback, not realizing they just needed to add accepted. The poller by design only processed ci-pending + accepted issues, so pre-approval sat in limbo.

Now: clean issue → accepted → ci-pending appears with comment → ci-ready (publish) or ci-failed (retry).

Race condition fix

ci-pending.yml and auto-approve.yml both fire on issues: opened and run in parallel. If auto-approve added accepted before ci-pending.yml added ci-pending, publish.yml's publish job would fire with accepted && !ci-pending — publishing without CI verification.

Fix: publish gate now requires ci-ready (added by the poller after CI passes), not just the absence of ci-pending.

State machine

opened → (no labels)
accepted added (human or auto-approve):
  waiting-for-ci → adds ci-pending, enables poller, triggers it, comments
  publish job    → skipped (needs ci-ready)

poller checks CI:
  CI passes → ci-pending → ci-ready → publish fires
  CI fails  → ci-pending → ci-failed, accepted removed, comment

accepted re-added after CI fix:
  waiting-for-ci → removes ci-failed, adds ci-pending, polls again

Changes

• Delete ci-pending.yml — no longer triggers on issues: opened
• publish.yml waiting-for-ci — absorbs the logic; fires on labeled: accepted, adds ci-pending (idempotent), removes ci-failed, enables poller variable, triggers poller
• publish.yml publish gate — requires ci-ready instead of just !ci-pending

Migration

Issues already in ci-pending state from the old design (e.g. #7876) won't be picked up automatically — removing the ci-pending label manually and re-adding accepted will trigger the new flow.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a22fda8. Configure here.}