feat: autonomous AI task lifecycle — auto-merge, circuit breakers, cleanup

[sigvardt]

Summary

Closes the auto-merge gap in the AI task lifecycle. Issues now flow fully from creation → orchestrator pickup → PR → CI → auto-merge → cleanup without human intervention.

New Workflows

• ai-auto-merge.yml — Auto-enables squash merge on AI PRs when all checks pass. Guards: AI branch only, no workflow file modifications, PR body must contain Closes #N
• ai-pr-body-check.yml — Ensures every AI PR body contains Closes #N for issue auto-close. Auto-fixes missing keywords
• ai-success-cleanup.yml — Post-merge: removes all AI labels, deletes branch, posts completion comment. Post-close-without-merge: relabels for retry with circuit breaker (3 close attempts max)
• ai-unstick.yml — workflow_dispatch to reset deadlocked issues (ai-review-ready + ai-debugging → ai-task + ai-debugging)

Modified Workflows

• ai-ci-recovery.yml — Added circuit breaker (10 attempts → ai-blocked), extended to trigger on Secret Scan failures, added concurrency groups
• ai-auto-rebase.yml — Added circuit breaker (10 attempts → ai-blocked), skips PRs with pending auto-merge to prevent force-push cancellation, added concurrency groups

Post-Merge Steps Required

1. Run branch protection update: gh api repos/sigvardt/linkedin-buddy/branches/main/protection --method PUT --input - to add secret-scan as required check
2. Trigger unstick workflow: gh workflow run ai-unstick.yml to reset issues Groups: make it production-grade #612, Notifications: make it production-grade #613, Cover image/banner: make it production-grade #614

Label State Machine

ai-task → ai-in-progress → ai-review-ready → (auto-merge) → (cleanup removes all labels)
                                    ↓ (failure)
                              ai-task + ai-debugging → (retry, up to 10x)
                                    ↓ (10x failures)
                              ai-blocked (human intervention required)