Fix factory PR authentication and automatic label enrollment

[JoshCLWren]

Factory PRs can stall because PR creation uses github-actions[bot] even though pushes use a trusted token, leaving Actions awaiting approval and CodeRabbit skipping review. Repository PRs missing factory labels also remain outside the review/merge queue.

Use PR_REBASE_TOKEN for PR creation while preserving workflow-token authentication for controller operations. Extend the trusted issue/PR reconciler to enroll eligible repository PRs on open, reopen, ready-for-review, and unlabel events and in its existing 15-minute sweep. Preserve unrelated labels and existing owner/stage; default missing ownership to factory:unowned, recover missing stage from trusted exact-head review verdicts, and otherwise request factory:review. Exclude forks, drafts, Dependabot, and Renovate. Complete metadata is left untouched; green checks alone never establish readiness.

Validation: all 22 authentication and visibility/enrollment Node tests passed locally, along with shell syntax, factory roster validation, and git diff --check. CI runs the regression suites. PR #2963's blocked CI and repair-guard runs were approved and stale ownership released.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: eb14192d-2f6e-4c5e-a482-3cb568feddc8

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!