docs(fleet-triage): design for org-wide PR/issue triage routine

[asachs01]

Design doc only — no workflow or script changes.

Why now

Survey of org automation on 2026-08-17 found two silent absence-of-signal failures running concurrently:

1. dependabot-janitor has been disabled_manually since 2026-07-21 — 27 days, 241 open Dependabot PRs — and nothing alerted on the gap. It produced zero failed runs because it produced zero runs.
2. dependabot-backlog.md, which dependabot-janitor.sh writes and whose comments name a downstream weekly digest routine as its consumer, 404s on main. It has never been committed.

Neither is reachable by hardening the merge policy, which is where all prior effort went (#28, #36, #38, #23). So liveness is component 1 of the design, not an afterthought.

What this specs

The gaps dependabot-janitor does not cover: liveness/deadman, issue triage (65 open), non-Dependabot PR triage (~175 open), the code-owner-blocked backlog, release decoupling, and agent-authored fixes.

Explicitly not a second merge policy. Dependabot merging stays dependabot-janitor.sh's job; the routine consumes its output buckets rather than re-classifying. That script encodes two production incidents a fresh implementation would re-learn the expensive way.

Findings that need a decision regardless of this doc

• required_status_checks is NULL on 20/20 sampled *-mcp repos. CI passing is enforced nowhere at the branch level. The janitor's gh pr checks read is the only CI gate in the system, and it has been wrong twice (fix(janitor): don't auto-merge grouped/major bumps with no CI to verify them #36, fix(janitor): treat all-skipping CI checks as no-CI, not green #38) with nothing behind it.
• harden(janitor): group classify() reads per-dep bumps (fail-closed) #23 is still a live hole. classify() retains the blanket grep -qiE '\bgroup\b' -> ELIGIBLE title shortcut; fix(janitor): don't auto-merge grouped/major bumps with no CI to verify them #36 added only a downstream guard for grouped PRs with no CI. A grouped PR with green CI still auto-merges on a title match — the node-datto-rmm#46 shape minus the no-CI leg. CONFLICTING; needs a rebase onto post-fix(janitor): don't auto-merge grouped/major bumps with no CI to verify them #36/fix(janitor): treat all-skipping CI checks as no-CI, not green #38 main, not a rewrite.
• harden(janitor): SHA-pin actions/checkout (org-token-handling action) #22 is obsolete and would regress if merged. It pins actions/checkout to v4.3.1; main already SHA-pins v6.0.3 via ci: bump deprecated Node 20 actions to Node 24 versions #24. Recommend closing with a pointer to ci: bump deprecated Node 20 actions to Node 24 versions #24.
• fix(janitor): add cortextos+conduit to dependabot-janitor repo scope #50 is MERGEABLE/CLEAN and ready.

Open questions in the doc

1. The CI-split precondition (task_1786765529531, per fix(janitor): add cortextos+conduit to dependabot-janitor repo scope #50) — the janitor was turned off deliberately. Nothing should re-enable it until this is answered.
2. Code-owner policy for resolving the blocked bucket.
3. Whether a Claude cloud routine can hold a GitHub App installation token — unverified.
4. Run budget across 100 repos.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}