fix(machine): CI-failure feedback adds agent:rework with GITHUB_TOKEN — labeled event never fires the workflow

## Bug: CI-failure feedback dead-letters — GITHUB_TOKEN label-add doesn't fire ai-teammate.yml

**Observed (gh-35, 2026-09-14):** dev run 34890748216 pushed `ai/gh-35` with a compile error → Quality run 34895279298 went red → the CI-failure feedback loop (feat #105) correctly posted the 🔧 comment and added `agent:rework` to issue #35 — **but no AI Teammate run fired**. The rework stayed queued forever until a human re-cycled the label.

**Root cause:** the label is added with the workflow's `GITHUB_TOKEN`. Events created by `GITHUB_TOKEN` never trigger new workflow runs (GitHub's recursion prevention — same class as #108 for pushes). `on: issues: [labeled]` is dead on arrival from that actor.

**Fix options (pick like #108 did for pushes):**
- add the rework label with a real token (the SOURCE_GITHUB_TOKEN / PAT already used for pushes elsewhere in the machine), or
- dispatch `ai-teammate.yml` via `workflow_dispatch`/`gh workflow run` from the feedback job (needs `actions: write`, already granted), or
- reuse the checkout App token if it has issues:write.

**Repro:** any `ai/gh-*` push whose Quality goes red — the 🔧 comment appears, the `agent:rework` label sits on the issue, and no run starts. Re-cycling the label with a user token fires it instantly (verified on gh-35: run 34895763879).

**Related wrinkle:** the dev agent hit its time budget 10s BEFORE the PR-creation step (log tail: `file_read agents/js/common/pullRequest.js` + `github_list_prs` at 20:50:00, session killed at 20:50:10) — the run still reports "success" and the review leg then fails fast with "PR Review Output Missing". Consider: (a) treat budget-cut as an outcome that doesn't arm the review, or (b) move PR creation into the workflow (deterministic step after the agent step), not into the agent's last 10 seconds.

Start in ai-teammate.yml and trace the CI-failure feedback job that adds agent:rework after a Quality run fails. Reproduce the gh-35 sequence, then choose and verify a trigger path using a real token or workflow_dispatch so the AI Teammate run starts; also check how the time-budget outcome affects the review leg and its missing PR output.

Written by the indexing model from the issue text.