feat: add bootstrap fleet reconciliation

[jmcte]

Summary

• Add manifest-managed issue label taxonomy and GitHub label reconciliation.
• Remove Claude Code generated surfaces and back out previously managed Claude files.
• Add weekly-safe fleet reconciliation with plan-only defaults, dirty-worktree blocking, reports, and draft PR mode.
• Require PR bodies to state whether auto-merge is enabled or explain why it is unavailable/unsafe.

Governing Issue

No governing issue is linked; this is bootstrap control-plane follow-up requested directly in this thread.

Validation

• npm run check
• npm run dev -- reconcile --workspace-root /Users/johnteneyckjr./src --repo bootstrap --json

Bootstrap Governance

• Changes are scoped to bootstrap-managed governance and reconciliation behavior.
• Contributor or PR guidance changes are reflected in README.md, .github/PULL_REQUEST_TEMPLATE.md, and docs/bootstrap/onboarding.md when applicable.
• No real secrets, runtime auth, or machine-local env files are committed.

Merge Automation

• Auto-merge is unavailable until required approval is satisfied; enable it once checks and review state allow it.

Notes

• GitHub label apply and home apply were intentionally not run locally; repo-local bootstrap apply was run and was unchanged.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b34539672c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[athena-omt]

Thanks — this is a strong step toward a real fleet reconciler, but I’m requesting changes for two blockers:

1. In src/fleet.ts, reconcileOneRepo() calls applyGitHub(manifest) when --apply-github is set without --apply-repo, but still returns status: "planned". The CLI summary also only talks about repo drift/status. So a mutating run can still read like a plan for that repo, which is too misleading for an operation that changes labels/settings.

2. The --apply-repo --create-pr --apply-github path does not handle “GitHub drift only” repos correctly. If repoDrift === false but applyGitHub === true, the code can still enter applyRepoThroughPullRequest(), which always does git commit -m .... On a repo with nothing to commit, that fails instead of applying GitHub drift and skipping PR creation.

Once those are fixed, I’d be happy to take another look. I reviewed the diff in the provided worktree and attempted lightweight local validation, but the worktree did not have the dev toolchain installed to run the TypeScript/Vitest gate directly.

Stale after follow-up commit d28ab2d fixed the fleet reconciliation blockers; checks are green.

[pheidon]

Approved after the pushed repair commit d28ab2d. The previous fleet reconciliation blockers are addressed and the full PR check set is green.

[athena-omt]

APPROVE — re-reviewed after d28ab2d. The prior blockers are resolved: reconciliation no longer creates GitHub-only worktrees before validating local repo presence, and branch push handling no longer silently claims success after failed pushes. Current checks are green.