Strip stale agent-* labels mechanically instead of by hand #738

Problem

Status labels outlive the work. On 2026-10-22 the board counted as in flight 11 issues and 43 pull requests that were already closed or merged, because nothing removes agent-working / agent-pr / agent-ready when an item stops being open.

Cleaning these by hand is a recurring chore and it silently rots between cleanups, so the board lies about what is being worked on.

Data at the time of filing

• closed issues still carrying agent-working or agent-pr: Merge queue ignores hold / manual freeze: a PASS at the tip is enqueued ~10 s later #602, A Bot session stops reading its queue while still reporting load: 1 (Dev: 11 unread, zero progress) #624, #632 merged three minutes after an INC was posted: the gate does not stop a merge, and a verdict that does not start the comment is invisible #637, Secrets: a turn that withholds a key fails every bash call (DSH_SECRETS_WITHHELD is not declared to shell-env) #653, AGENTS.md: T2/T3 merge without a maintainer approve — write the mechanical gates down #695, tree load: end a turn by its turnId, not by whichever start is oldest #696, audit-merges: report only bypasses newer than a watermark, and run it on a read-only patrol #697, #681 follow-ups: a failed first send must still open the new Bot, and cells.js/parts.js must agree on kickoff lines #698, Team prompts: a Bot stays idle until it is addressed or given a task (part B of #645) #699, Remove the retired awaiting-approval label from labels.json and its test #702, enqueue guard: refuse a pull request with no issue reference or no agent-pr label #718
• closed pull requests still carrying agent-pr: 43

What to build

1. .github/scripts/label-hygiene.mjs — Node, no dependencies, GITHUB_TOKEN plus the repository from the event or an argument. It lists issues and pull requests with state != open that carry any of agent-working, agent-pr, agent-ready, agent-task, awaiting-approval and removes only those labels.
   • default is a dry run that prints one line per item (#NNN <title> -<label>); --apply performs the removals.
   • idempotent: a second run on a clean repository reports 0 items.
   • never touches bug, area:*, risk:*, hold, needs-*, status:done.
   • paginates; rate-limit friendly (one list call per kind, one remove call per label).
2. .github/workflows/label-hygiene.yml — schedule once a day (pick a quiet hour, e.g. 30 19 * * * UTC) plus workflow_dispatch; least permissions (issues: write, pull-requests: write, contents: read); runs --apply.
3. .github/scripts/label-hygiene.test.mjs — node:test, fixture pages: an open issue with agent-working stays untouched, a closed issue has exactly the status labels removed and bug/risk:T1 kept, a merged PR loses agent-pr, an issue with only bug produces no removal call.

Acceptance

• running --apply against this repository leaves zero non-open issues and pull requests carrying those five labels; a second run reports 0.
• the test file fails if the state != open filter is dropped, and fails if the keep-list is dropped (a fixture that carries bug loses it).
• workflow passes actionlint / the repo's workflow test (test-workflow.test.mjs) if that check covers new workflows.

Out of scope

Changing the label set, deleting labels from the repository, touching hold (only a human removes it), and any change to the merge queue.

Before the first --apply

The run must print its own work count so the cleanup can be verified rather than trusted: a before: N items / M labels line in the dry run, and the same figures in the --apply run followed by after: 0 items.

The first --apply against this repository is expected to report 43 pull requests and 0 issues (measured 2026-10-22 with is:closed is:pr label:agent-pr and the three issue queries, all 0). If the numbers differ, stop and report the difference in the pull request instead of adjusting the expectation.