✨ Workflow models: safe label garbage collection on rebind and model-defined human-gate replies - #17710

Closes two RFC phase-4 gaps of the workflow-models RFC: model labels were never removed once a repository was unbound or rebound, and a bound model's replies (the human-gate verbs it declares per state) were never offered or accepted. P4's "done when … the change regenerates labels and commands" now holds for both halves.

Refs #17620

A. Safe label garbage collection on unbind / rebind

ensureStageLabels already provisions a bound model's LabelDefs. It now remembers what it provisioned and reconciles when the binding changes (pkg/github/automerge/automerge_stage_labels_gc.go):

• Record — one JSON per repository, workflows/provisioned/<owner>__<repo>.json under data.workflows_dir (workflowmodel.ProvisionedLabels{repo, model, hash, labels[]} via the new ProvisionedStore interface the workflow store implements). It is the hive's memory of the labels it created or adopted for a model.
• Diff — when the profile hash differs from the record (rebind, new version, unbind → nil/hive-default), compute previous − current.
• Delete only when all hold: the label is in the record; it is not in the built-in family (stagelabels.LabelDefsFor + Renames); no open issue/PR wears it (label:"x" is:open search — a failed search keeps the label and logs); workflow.label_gc is on. Kept labels stay in the record and are retried next pass. Every deletion is audited workflow_label_removed.
• Knob — workflow.label_gc (WorkflowConfig.LabelGC *bool, default true). false keeps everything and logs what would have gone. Yaml-only; added to settings_parity_allowlist.txt.
• Unbound repositories: zero change — no store wired / never bound ⇒ nothing remembered, nothing deleted; the existing stage-label tests are untouched.

B. Model-defined replies → human-gate verbs and /hive <verb>

For a repository bound to a non-default model only:

• Profile.RepliesForNumber(stage) / ReplyForNumber(stage, verb) → ReplyEffect{Verb, From, To, Label} (the transition whose on event is the verb, its target state, and the label labels.entries maps to that state, if any). NormalizeReply folds case/whitespace/leading slash.
• Comments — parseUnparkCommandFor tries the model's verbs first (multi-word, longest match, trailing punctuation trimmed; rest of the line is the decision text), then the built-ins. With no verbs it is the old parser. On a parked issue applyIssueModelReply clears parking labels as /hive approve does, applies the mapped label (audited hive_label_applied with reply=<verb>), and posts one comment that keeps the Decision: round-trip intact and says what the model did. Answered replies are watermarks. cmd/hive passes the stage engine's WorkflowFor to the un-park sweep.
• Dashboard — tracker payload workflows.repos[<repo>].replies (stage number → verbs; hive-default block carries none). stageTrackerHumanGateVerbs appends them after the built-ins, deduped by label, as wf:<verb> actions → prompt for an optional note → POST /api/repos/{repo}/items/{n}/decision {"decision":"model-reply","reply":…}. The handler resolves the bound profile, 409s unbound repos / verbs not offered at the item's state, 400s PRs, audits repo_item_decision_model_reply.

C. Docs

• docs/design/workflow-models.md — appended "Label GC and model commands (RFC phase 4, follow-up)".
• docs/maintainer-commands.md — new "Model-defined replies" section.
• changelog.d/added-workflowmodel-label-gc-commands.md.

Tests

• automerge: rebind removes stale, keeps in-use, keeps built-in, keeps non-provisioned, honours label_gc=false, persists/updates record, memo resets, search failure keeps label, audit emitted; unbound path unchanged.
• workflowmodel: NormalizeReply, reply resolution per state, event→label match; store: provisioned record round-trip.
• github: parser table (bound vs unbound, multi-word, punctuation), verbs by state / hive-default skipped, sweep applies mapped label, unknown verb on unbound repo, operator path ok/refusals/argument errors, reply wording branches.
• dashboard: payload replies per block, workflowProfileForRepo, handler (unbound 409, blank 400, unknown 409, PR 400, success applies labels + audits), index.html wiring strings, node fixture for stageTrackerWorkflowReplies / stageTrackerHumanGateVerbs / stageTrackerModelReplyVerb.

Coverage: automerge 88.5%, github 88.3% (floor 88), stageengine 94.0% (floor 90), workflowmodel 93.8% (floor 90), config 90.0%. Stage goldens unchanged. pkg/dashboard passes except the two known macOS-only failures.

Known gaps

• Model replies act on parked issues only: verbs on PR states (e.g. TechDocs draft-review: approve / request changes) are not offered or honoured; PRs keep GitHub's native review. Un-parked states with replies are not answered.
• The pill shows model verbs only where it already shows a human gate.
• GC trusts the provisioned record: labels a model dropped before this shipped are never reclaimed automatically.
• Footprint note: cmd/hive/main_sweeps.go (one option) and api_repo_item_decision.go (one decision case) were touched because the pill needs a server endpoint; no api_workflows*, openapi.json or Workflows-tab JS changes.