pipeline: make stop labels sticky and PR policy checks blocking

[WalksWithASwagger]

Summary

Make stop labels sticky and expose one stable, blocking pull-request policy check for traceability and human gates.

Context

• Blocked by review: PR #305 dark-crystal style human gate #307 and docs: remove Linear from active delivery instructions and mirrored skills #325.
• Roadmap phase: Phase 3 - workflow integration
• Relevant files: the renamed agentic traceability workflow, .github/workflows/agentic-pr-review.yml, scripts/agentic/pr_review.py, tests/agentic/test_workflows.py, tests/agentic/test_pr_review.py, tests/agentic/test_pr_traceability.py, .github/branch-protection.md, and docs/DELIVERY-PIPELINE.md
• Current behavior: comments and labels express policy, but automation can clear stop state and no stable required check makes the policy authoritative.
• Desired behavior: a check named policy fails on traceability drift, needs-human, or blocked, and automation can never grant human approval.

Implementation Notes

• Resolve review: PR #305 dark-crystal style human gate #307 first so the existing non-canonical PR does not become an accidental permanent exception.
• Keep advisory comments and labels, but make check conclusion the enforceable result.
• Run the policy check on relevant PR and label changes.
• Do not mutate repository settings in this implementation issue.

Acceptance Criteria

• No automation removes needs-human or blocked.
• A stable check named policy runs for every PR and relevant label change.
• policy fails for traceability mismatch or either stop label.
• Advisory comments and labels cannot override the check conclusion.
• Automation cannot create or infer human approval.
• Workflow tests cover labeled, unlabeled, edited, synchronized, and reopened pull requests.

Tests/Evals

• Add negative tests for mismatched issue numbers and sticky stop labels.
• Add event-matrix tests proving the stable check is emitted for every relevant trigger.

Verification

• python3 -m pytest tests/agentic -q
• python3 -m ruff check scripts/agentic tests/agentic
• npm test
• Parse the workflow YAML and confirm the required check name remains exactly policy.

Agent Instructions

• Use branch codex/issue-<this-issue>-blocking-policy-check.
• Do not start until review: PR #305 dark-crystal style human gate #307 and the active-doc migration are complete.
• Preserve least-privilege workflow permissions and no-auto-merge behavior.
• Do not call the GitHub settings API.

Human Checkpoints

• A maintainer must review the final event matrix and check name before it becomes required in repository settings.

Out of Scope

• Applying branch protection or rulesets.
• Choosing an approving-review count.
• Merging or closing PRs.
• Dependency or package changes.

Linear

Not applicable. Rafiki delivery is GitHub-only; do not create or update a Linear issue.

[github-actions]

Agentic dev loop started on branch codex/issue-326-pipeline-make-stop-labels-sticky-and-pr-policy-c with provider noop.

[github-actions]

Agentic dev loop finished without opening a PR. Status: no-pr. Provider: noop.