Filter Renovate and puppetsync PRs out of the triage-board intake (#97); move #98/#99 labelling to the org reconciler

[silug]

Closes #97. Addresses #98 and #99 together with simp/gha-workflows#12 — the labelling half of both issues lives there, not in this template, for the reason under Why #98 is not a per-repo step.

What changes here

• add_new_issue_to_triage_project.yml template gains a job-level if: (Triage workflow should not auto-add Renovate and [puppetsync] PRs to the Org Triage board #97): PRs by renovate[bot] / dependabot[bot] and [puppetsync]-titled sync PRs are no longer added to the Org Triage board. Issues and every other PR still are — drive-by PRs from outside contributors are what the board exists to catch. The explicit event_name guard is used rather than relying on startsWith(null, …); the template documents that the title prefix is a convention set by each sync config's commit_message, not enforced. It also now carries the standard puppetsync NOTICE header (it was the only workflow template without one).
• merge_github_workflows.project_types — new optional session setting for the merge stage (default unchanged: pupmod, pupmod_skeleton). A merge scoped to one shared template can now reach the rubygem and simp_unknown repos, which carry the same workflow, without a blanket apply_puppet_role (they are enforce-strategy, so an apply would rewrite their whole baseline). BoltSpec covers it.
• Session config 20260903-triage-intake-filter.yaml (now latest.yaml): merge scoped to this one file across pupmod, pupmod_skeleton, rubygem and simp_unknown. The rubygem-simp-* repos had no puppetsync baseline before; the first fleet run produced exactly the expected single-file change on all six, so this shared workflow becomes the first piece of one (decided 2026-09-03). ensure_files lays the file down where it is missing.
• merge_gha_workflows bug fix: ensure_files wrote the template without creating .github/workflows/, so a repo with no workflows at all (rubygem-simp-build-helpers) failed with ENOENT on the first fleet run. The task now mkdir_ps the parent; spec added and verified end to end on that clone.

Why #98 is not a per-repo step

#98 as filed keys on github.event.pull_request.author_association. In Actions event payloads that field reports CONTRIBUTOR for org members whose membership is private (flutter/flutter#101012, apache/arrow#34381); the reconciler hit the same thing via the API ("Trusting it made the mapping treat 29 org members as outside contributors"). 20 of simp's 32 members are private, so the per-repo step would have stuck a permanent community label on most of the team's PRs and issues. The reconciler already resolves membership from the org member list, so community and needs-attention are both applied there: simp/gha-workflows#12.

Verification

• rspec: 232 examples green; BoltSpec merge-stage spec: 6 examples green (new project_types case included); actionlint passes on the template.
• list_pipeline_stages dry run against the real config: install_gems → checkout → merge_github_workflows → git_commit_changes → ensure_github_fork → ensure_git_remote → git_push_to_remote → ensure_github_pr.
• End-to-end on local clones of pupmod-simp-aide, rubygem-simp-cli, puppet-gpasswd: exactly one file changed per repo, byte-identical to the template — except aide, which correctly kept its Renovate-pinned uses: actions/add-to-project@v2.0.0.

Rollout

bolt plan run puppetsync repolist=github-org (config is latest.yaml). First fleet run (from e708205) opened 78 PRs — 71 pupmods, puppet-gpasswd, 6 rubygems — and failed on rubygem-simp-build-helpers (the mkdir_p bug above). All 78 swept: one commit, one file, byte-identical to the template except 9 that kept an existing Renovate-pinned uses ref. A re-run from the current head adds build-helpers and is otherwise a no-op.

🤖 Generated with Claude Code