feat(ci): enforce the ready-for-review gate

[dhruv0811]

Related issue

Part of OMNI-2214 / OMNI-2315. Flips the flag on the gate merged in #4179; this PR
declares Test / CI below, which is one of the exempt types.

Summary

The ready-for-review gate has run dry since it merged, and its verdicts hold up: the
PRs it marks ready all reference an open issue, are not drafts, and are not waiting
on their author. Verified twice against live GitHub with the label write rigged to
throw, so "nothing was touched" was proven rather than assumed.

Until this flips, no open PR carries waiting-for-review — the only entrance was
the author-reply handoff, so a fresh PR that references an issue got nothing, and the
label cannot yet be used as the review queue it exists to be.

No LIMIT, unlike the issue nudge. Applying a label notifies nobody and is
trivially reversible, so there is no first-run blast radius to bound. The nudge
needed a cap because it comments on a contributor's PR; this does not.

A maintainer who removes the label is respected: the sweep will not reapply a label a
human took off (removedByHuman), and it ignores the bot's own mutual-exclusion
removals.

Four PRs qualify at the time of writing: #4187, #4178, #4128, #4113.

Test Plan

• node .github/workflows/ready-for-review.test.js passes (all predicates and
  exclusions: PR / closed / draft references rejected, quoted examples rejected,
  drafts skipped, waiting-on-author wins, idempotent, human-removal respected,
  bot-removal ignored, write failure does not abort the sweep).
• Two live dry runs against production, most recently
  Done (enforce=false). below bar=22 READY=3 skip=2, with the label write rigged to
  throw and no write attempted.
• The handoff half of this label pair has been live since feat(ci): hand PRs back to the reviewer with waiting-for-review #4157 and was verified end
  to end on a real PR, including mutual exclusion in both directions.

Demo

N/A. One environment variable in a CI workflow.

Type of change

• Bug fix
• Feature
• UI / frontend change
• Refactor / chore
• Docs
• Test / CI
• Breaking change

Test coverage

• Unit tests added or updated
• Integration / E2E tests added or updated
• Manual verification completed
• Not applicable

Coverage notes

Not unit-testable: this changes a workflow environment value, and both the enforcing
and dry-run paths are already covered by the existing tests. Verification was the
live dry runs described above.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[omnigent-ci]

Polly AI Review

Blocking issues

None. The functional change is a single environment flip (ENFORCE: "false" → "true") that arms the already-merged ready-for-review gate. I verified the enforcement path in ready-for-review.js and it holds up:

• Labeling is per-PR inside a try/catch, so one failed write does not abort the sweep (ready-for-review.test.js covers "the sweep continues past a write failure").
• Rate-limit errors (429 / "rate limit") are re-thrown from the inner catch and handled gracefully at the top level, so a rate-limit hit exits cleanly rather than partially labeling.
• The skip predicates are sound: drafts, PRs already carrying waiting-for-review, PRs with waiting-on-author (mutual exclusion), and removedByHuman (bot removals ignored via the [bot] actor check) are all excluded before the bar is evaluated.
• Idempotency and human-removal respect are enforced and tested.
• node .github/workflows/ready-for-review.test.js passes locally ("all assertions passed").

The job already grants pull-requests: write and issues: write at the job level, so the label write has the permissions it needs once enforced.

Security vulnerabilities

None. The workflow checks out only the pinned default-branch .github sparse tree with persist-credentials: false, never the PR head, so no PR-authored code runs. The action refs remain pinned by SHA. No secrets are touched, and the added capability (applying a label) is low-risk and reversible.

Non-blocking notes

• The updated comment claims the gate "has run dry since it merged" and enumerates four qualifying PRs; those are point-in-time observations that will age out — fine for a PR description, and the code comment itself stays generic, which is good.
• Worth confirming the waiting-for-review label exists in the repo before this first enforcing run; addLabels will surface an error per-PR (caught and warned) if it's missing, so a missing label degrades to a no-op warning rather than a hard failure — acceptable, but a quick pre-check avoids a noisy first sweep.

Summary

A minimal, well-scoped CI change that flips the ready-for-review gate from dry-run to enforcing. The underlying enforcement logic is defensive (per-PR error isolation, rate-limit handling, idempotency, human-removal respect) and fully covered by the existing test suite, which passes. The comment edits accurately describe the new behavior and correctly justify the absence of a LIMIT. No visual demonstration is required (pure CI/backend change). Approve.

---

_{Automated review by Polly · workflow run}

[github-actions]

🏷️ Doc impact: no-doc-update

The change only flips a CI workflow's ENFORCE flag and comments for a ready-for-review label gate, an internal CI/tooling change with no user-facing surface or integration affected.

_{Auto-classified on merge. Set the label manually before merging to override. · run}