fix: complete ceremony 0.3.0 labels adoption

.github/labels.conf

@@ -1,4 +1,5 @@
 panel=claude-bot-andresmgsl codex-bot-andresmgsl grok-bot-andresmgsl kimi-bot-andresmgsl
+triage-actors=dan-claude-bot
 scope:bootstrap|C5DEF5|bootstrap — hardening a pristine server into a node
 scope:users|C5DEF5|users-* — class model, apply/status, close-root
 scope:runner|C5DEF5|runner-* — GitHub runner lifecycle

.github/workflows/labels.yml

@@ -8,9 +8,13 @@ on:
   schedule: [{cron: "*/15 * * * *"}] # advisory; the handoff label is the real wake
   workflow_dispatch:                 # bootstraps missing labels on a fresh repo
   pull_request_target:
-    types: [opened, reopened, ready_for_review, converted_to_draft, synchronize, labeled, unlabeled]
+    types: [opened, reopened, ready_for_review, converted_to_draft, synchronize, labeled, unlabeled, review_requested, review_request_removed]
+  issues:
+    types: [opened, edited, assigned, unassigned, labeled, unlabeled, closed, reopened]
 permissions:
   contents: read
+  checks: read
+  statuses: read
   issues: write
   pull-requests: write
 jobs:

CONTRIBUTING.md

@@ -24,7 +24,8 @@ genuinely rig's.
    `bash test/release.sh` locally mirror what CI runs; the db dump/restore
    round-trip (`test/db-integration.sh`) executes in CI where Docker is
    present. The release guards (`changelog-armed`, `changelog-monotonic`,
-   `drill-recorded`, `docs-sync`) run as ceremony's pinned actions.
+   `changelog-assembled`, `drill-recorded`, `runner-isolated`, `docs-sync`)
+   run as ceremony's pinned actions.
 4. **Feature PRs land their changelog entry as part of the PR**: write
    `changelog.d/<issue>.md` — the release PR assembles those fragments into
    the release notes verbatim.