Contributor lane: approve held workflow runs for registry-trusted authors #14519

Observed

hivecommons/docs#481 by @thatguywob (fork PR; the author holds registry trust tier trusted in this hive's contributor registry) sat 17+ hours without CI on 2026-10-27.

The contributor lane admitted the PR (contributor-lane:registry-trusted) and then skipped it every tick with required-check-missing:Audit production dependencies. GitHub had created the pull_request workflow runs for head 71d7049b but held them with conclusion=action_required under the repo's fork-approval policy (first_time_contributors_new_to_github), and the docs repo has no ok-to-test automation. Nothing would ever start those runs; the operator had to approve them by hand (POST /repos/{o}/{r}/actions/runs/{id}/approve).

Why the existing held-run handling does not cover this

src/pkg/github/automerge/automerge_held_runs.go already detects held / never-started required checks, but deliberately acts only for the App's own PRs and configured trusted bots: "human-authored lanes are untouched so a first-time contributor's held run is never nudged by automation". The hive-ok-to-test workflow (src/pkg/oktotest) likewise approves only same-repo heads, never fork heads.

That caution is right for unknown contributors. It is wrong for a contributor the operator has explicitly placed in the registry at a tier the contributor lane accepts for merging (auto_merge.contributor_lane.require_tiers, default trusted / merger). If the operator trusts the author enough to merge their PR unattended, holding their CI for a manual click is pure drag.

Proposal

In the contributor lane, when the author is admitted via the registry path only (claim.admittedByRegistry() — not auto-promotion, not claim marker, not association) and the lane's CI reason is required-check-missing:<ctx> with action_required runs for the head:

• approve those runs once per head via POST /repos/{owner}/{repo}/actions/runs/{run_id}/approve, reusing the detection and once-per-head bookkeeping in automerge_held_runs.go;
• refuse when the PR carries the sentinel label or any contributor-lane exclude label (hold, do-not-merge, needs-human, …), or touches .github/workflows/** (existing diff fence);
• config toggle auto_merge.contributor_lane.approve_held_runs_for_registry_trusted (default true);
• post one idempotent PR comment (<!-- hive:contributor-held-runs-approved … -->) saying the hive approved the held runs because the author is registry-trusted at tier X, and log msg="contributor-lane approved held runs" with repo/pr/head/author/tier/run_ids;
• update the header comment in automerge_held_runs.go and the operator docs that currently say human lanes are never touched.

Note: the approve endpoint needs the App's Actions: Read and write permission; without it the call fails with 403 and the lane keeps today's behaviour (logged once per head).