Derived-record PR opener: one queen-publish.yml job opens the PRs the labs' seal and ledger verdicts allow #9092

Part of epic #9025 (downtime). This is the write path for the seal refresh runner (see #9080) and the t27b ledger steward (see #9091).

Problem

The two labs can recompute master's derived records, but neither holds a GitHub credential, and none may be added:

• t27c-lab re-saves gen-drift seals (Seal refresh runner: apply derived_data.t27 V_REFRESH on the lab, so no PR inherits stale-seal red #9080);
• t27b-lab composes ledger rows (t27b ledger steward runs on the lab: ledger_steward.t27 composes the ledger from master's red ratchet #9091).

So a person still has to open each PR by hand. On 2026-10-11 that meant:

• three seal PRs: seals: re-save golden_chain and derived_data after the gen-rust change (Refs #9027) #9070, seals: re-save holds and issue_shape with master's t27c (Refs #9027) #9073, seals: re-save the two stdmem seals with master's t27c (Refs #9027) #9079;
• five ledger PRs: t27b ledger: rows for 9 specs merged without one (Closes #8287) #8289, t27b ledger: master's native run at c9d36f314, row by row (Closes #8322) #8548, t27b ledger: rows for 9 more specs that landed without one (Closes #8645) #8646, t27b ledger: name specs/queen/keyed_guard.t27, so the master ratchet stops reporting it UNLISTED (Closes #8664) #8665, t27b ledger: max_not_pass 20 -> 19 after #8695 and #8696 (Closes #7917) #8697.

Meanwhile every open PR inherited master's red.

.github/workflows/queen-publish.yml already opens PRs on a cron (9,39 * * * *) with GH_AGENT_TOKEN; GITHUB_TOKEN may not create PRs in this repository. brain-seal-refresh.yml opens no PR; its push step was removed. So extending queen-publish is the DRY choice. No new workflow.

User Scenarios

• Given master's tip with /seals/<sha>.json verdict REFRESH on t27c-lab, when the job runs, then:
  • it opens one issue;
  • it pushes branch bot/seals-<sha12> with the patch, touching only .trinity/seals/;
  • it opens a PR whose body starts Closes #<issue>;
  • it enables --auto --squash while checks are pending (derived_data.t27 bot_pr_action: B_WAIT).
• Given /ledger/<sha>.json verdict APPLY on t27b-lab, then the same happens with branch steward/t27b-ledger-<sha12>, touching only docs/reports/t27b_expectations.json. The issue is labelled t27b-ledger-steward (job card specs/jobs/t27b_ledger_steward.t27, steps 3-6).
• Given /ledger/<sha>.json verdict REFUSE, then it opens one refusals issue for that run (card step 1) and no PR.
• Given a branch, PR or issue already exists for that commit, then a second run opens nothing.

Requirements

• FR-001: The job MUST refuse a patch unless:
  • its json verdict allows it (REFRESH for seals, APPLY for the ledger);
  • every path it touches is its kind's derived path (derived_data.t27 derived_path_kind);
  • git apply --check passes on master's current tip.
• FR-002: It MUST be idempotent per kind and commit. It never opens a second issue or PR for one commit.
• FR-003: A bot PR whose base is no longer the tip MUST be closed when a newer one is opened (bot_pr_action B_REGENERATE). It is never rebased.
• FR-004: The job MUST be one job in queen-publish.yml, and the PR MUST be net <= 0 in hand-written foreign lines (policy: hand-written code in any language but t27 may only shrink (Closes #8227) #8236). Editing a workflow needs the owner's owner-approved-foreign label.

Success Criteria

• On the next master merge that moves gen output or adds an unlisted spec, a bot PR appears within 30 minutes of the lab run.
• With that PR merged by auto-merge, master's coverage and t27b-native-ratchet checks are green within 60 minutes of the merge, with 0 hand PRs.

Boundary

• .github/workflows/queen-publish.yml