feat(workflow): only poll accepted issues, add ci-failed state machine

[BYK]

Summary

Two changes to eliminate wasted polling on abandoned releases:

1. Only poll issues with both ci-pending AND accepted

The poller now ignores issues that nobody has approved. Abandoned releases with ci-pending but no accepted label cost zero poller time.

2. CI failure → ci-failed label + remove accepted

When CI fails, the poller:

• Swaps ci-pending → ci-failed (red label)
• Removes accepted so the poller stops checking this issue
• Comments with the failed check names and a link to check runs

To retry: fix CI, then re-add the accepted label. publish.yml detects ci-failed + accepted, swaps back to ci-pending, comments, and immediately triggers the poller via workflow_dispatch (using app token).

State machine

opened → ci-pending

accepted added → poller starts checking (ci-pending + accepted)
  CI passes   → ci-ready → publish starts
  CI fails    → ci-failed, accepted removed → waiting for human

accepted re-added → ci-failed → ci-pending → poller retries

Changes

• ci-poller.yml: Filter by --label ci-pending --label accepted. On failure: swap labels, remove accepted, comment.
• publish.yml: waiting-for-ci job handles ci-failed → ci-pending swap when accepted is re-added. Triggers poller via gh workflow run with app token. Publish gate now also excludes ci-failed.

Pre-requisite (already done)

Created ci-failed label (red #D93F0B) in the repo.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit efb9fac. Configure here.}