ci: admit dedicated Gyeot runner label in global policy

[seonghobae]

Scope

Narrow additive follow-up for global self-hosted routing owner #2565. Admit only the existing dedicated group CWL Gyeot CI with exact label gyeot-ci in the shared source-policy and actionlint contracts. Preserve all existing group mappings, labels, unknown-group fail-closed rejection, and hosted-fallback denial.

Evidence

• TDD RED 1: CWL Gyeot CI was rejected as unsupported.
• TDD RED 2: policy mapping passed but actionlint config lacked gyeot-ci.
• Focused owner contracts: 5 passed normally and 5 passed with GITHUB_ACTIONS=true, zero skips/failures.
• actionlint 1.7.12 passes the exact published Gyeot workflow from ci(gyeot): add central self-hosted verification #2611.
• Independent exact-hash review passed with zero security/logic findings.

Boundaries

This does not provision a runner, change group ACLs, borrow CWL CI isolated or privileged control/review pools, enable a hosted fallback, or claim runtime isolation/canary. Fresh group inventory before publication: org group 9 selected only ContextualWisdomLab/gyeot, zero runners. Consumer remains central Draft #2611. This PR is stacked on #2565 to avoid copying/reverting its global owner changes.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2677fcb1-4e3d-4518-a1c7-fa781c383ff4

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Updated owner reconciliation and review admission — October 10, 2026 KST

Current exact head99a32368d1e7366d9abebdb27f89352cddb3a8f3, ordinarymerge parents67726a07 andglobalowner ef0c9d4, treebb24db20c10982e072eebdef29344f5b13feec46. Bounded independent integration review PASS: owner742paths compared, only originaltwochildfiles differ; owner27filechanges preserved, no newmerge-inducedsecurity/logicregression. Parent actual Actions-mode53tests/45subtests passed. Source-local verdict is NOT qualifyingAppapproval.

Advancing from Draft for the existing ready_for_review lifecycle; no duplicate dispatch or predetermined verdict. Known owner-side issue remains explicit: Noema sidecar upload has always()+PRnumber without current-sidecar/Draft producer gating, so artifactstoragequota can fail it before publication. The child does not modify or clear that issue. Real literalauto model invocation, independent App identity, exacthead/base binding and normal requiredchecks remain necessary; a skipped bot or local reviewer is not APPROVED. Dedicated Gyeot runner provisioning is not part of these2files and no ACL/group mutation was made.