Fix protected-path approval label event handling

Parent and purpose

This is a bounded repair under #72. It fixes the approval workflow defect discovered while preparing recruiter-readiness PR #71.

PR #71 must remain frozen at its independently reviewed head 7653743a0f5bfeb76d164172374067ebdb6a2573. This issue owns a separate workflow/test change and must not modify PR #71.

Confirmed defect

.github/workflows/protected-paths.yml reads github.event.pull_request.labels, but its pull_request trigger uses the default activity set. Adding or removing approved-test-change therefore does not start a new guard run. Re-running an older workflow run also reuses the old event payload.

Required repair

• Explicitly retain the normal pull-request activities required by the repository.
• Add labeled so applying approved-test-change starts a fresh guard run at the current exact head.
• Add unlabeled so removing approval immediately starts a fresh guard run and invalidates prior approval.
• Add regression-sensitive test/audit coverage for the exact trigger contract and exact label name.
• Preserve fail-closed behavior for protected-path changes without the exact approval label.
• Do not weaken, skip, narrow, mock away, or bypass protected-path enforcement.

Acceptance criteria

• Dedicated draft PR against main; no change to PR #71.
• Workflow explicitly handles opened, synchronize, reopened, labeled, and unlabeled.
• Tests fail if labeled or unlabeled is removed.
• Tests fail if the exact approved-test-change requirement is broadened or removed.
• Relevant local and hosted checks pass at the exact remote head.
• Producer self-review is published append-only.
• Strategy exact-head verification is complete.
• Codex independent exact-head review is CLEAN.
• Founder applies the approval label after reviewing the final exact diff.
• Founder alone performs the documented one-time break-glass merge needed to bootstrap the repaired gate.
• After merge, removal and re-addition of the label on frozen PR #71 produces fresh failing/passing guard evidence without closing/reopening or moving its head.

Bootstrap boundary

The existing broken workflow cannot prove its own event-trigger repair. It may therefore remain red on the repair PR solely because no label event can trigger the old workflow. This is not permission to ignore any other failure.

A one-time founder merge exception is permitted only after:

1. exact-head implementation and hosted evidence are complete;
2. Codex independently returns CLEAN;
3. Strategy verifies that any remaining red guard is solely the already-proven bootstrap limitation; and
4. the founder reviews the final exact diff, applies approved-test-change, and personally performs the merge.

Agents must not mark ready, merge, enable auto-merge, deploy, publish, change provider settings, or use this exception for any other PR.

Roles

• Producer: Claude, bounded implementation on this issue only.
• Independent reviewer: Codex, after producer completion and Strategy exact-head verification.
• Merge authority: founder only.

Start with .github/workflows/protected-paths.yml and inspect its pull_request trigger, existing checks, and any audit or regression coverage. Verify the exact opened, synchronize, reopened, labeled, and unlabeled contract and the exact approved-test-change label, then run the relevant local and hosted checks. Done means protected-path changes remain fail-closed and label changes produce fresh evidence at the exact remote head.