[chrischeng-c4]

CI lifecycle handoff is missing. This wires the unchanged policy-aware controller from reviewed aw #72 merge 67af8d020df3ca2ec4b064289408cfb0c2f8b299, trusted default-branch checkout/configuration, minimum read plus issues-write permissions, serialized reconcile-all wakeups, and explicit required workflow/job identities.

This rollout is explicitly failure-only: confirmed current-head required-gate failures return active doing issues to todo with exact run/job links. Success, missing/skipped/pending evidence never creates done, and already done issues remain untouched. AGY owns only todo → doing. No auto-merge or review acceptance is granted.

Coverage gaps remain in the nonempty qualification_blockers list. The guard imports the shared controller validation API, rejects an old controller without evaluate_policy, and refuses missing/malformed policy, full mode, or cleared blockers. The controller also suppresses done for blockers even if a future caller accidentally selects full. Existing green checks cannot stand in for missing approved MR qualification; this PR does not claim those gaps resolved. No new GKE/provisioning/performance jobs, trigger expansion, credential changes, manual dispatch, or automation schedule changes.

The pinned controller protects stale heads, latest rerun attempts, parallel gates, linked issue association, unrelated labels, and deduplicated handoffs including partial journal recovery after AGY reclaim. It never executes PR-controlled code or trusts artifacts for permission. Review after a separately approved full qualification rollout independently verifies the same head and never merges.

Validation: PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s scripts/issue-ci/tests -v — 10 tests pass. Includes exact live gate completeness, pinned bytes, failure-only success with/without blockers never done, accidental full with blockers never done, guard malformed/full/cleared/old-controller refusal, missing workflow/each job, skipped/cancelled/neutral/pending, stale/foreign heads/current attempts, and actual mocked API failure handoff preserving labels/links with success/done no-write cases. git diff --check passed. Only affected local unit/static tests were run.

Existing mandatory gate: .github/workflows/keep-ci.yml (keep-ci) / fmt, clippy, tests, release contract. The GKE pilot #6 remains unmerged and is not treated as current-main coverage. Decisions still needed: merged current-head affected cloud functional/e2e qualification and approved affected performance qualification. Existing unit/integration/release-contract checks alone do not prove the full MR policy. Release full qualification is a separate rollout.