ci: verify the Renovate auto-merge path end-to-end on a real qualifying PR

[castrojo]

What

The Renovate/MergeRaptor auto-merge path (renovate-automerge.yml → reusable-renovate-automerge.yml) is live and has run successfully in production, but only the skip path has ever executed — every run so far has logged "No qualifying Renovate/Mergeraptor PR — skipping". The gates, the app-token mint, and the merge step itself have never been exercised against a real qualifying PR.

Why it matters

Two things are verified only by inference:

1. secrets used in a job-level env: block. reusable-renovate-automerge.yml mirrors credential presence into env.HAS_APP_CREDS because the secrets context is unavailable in step-level if:. actionlint 1.7.7 accepts it and the workflow runs green, but the GitHub documentation is ambiguous about whether secrets is formally supported at job-level env in a reusable workflow. If it silently evaluates to empty, the app token is never minted, the job falls back to github-actions[bot] — which has no branch-protection bypass — and the merge fails at the last step.

2. The merge step's outcome reporting. It queries gh pr view --json state rather than trusting exit codes, which is correct in principle but untested against a real merge.

How to verify

Wait for (or force) a qualifying Renovate PR — one authored by mergeraptor with autoMergeRequest != null — and confirm from the run log that:

• the app token step ran (not skipped) and the merge identity is mergeraptor, not github-actions[bot]
• all three gates evaluated as expected
• the PR reached MERGED state, not OPEN (enqueued)

Checklist for the wiring itself is in docs/skills/factory-operations.md → "Verification — is auto-merge actually wired up?".

Automatable

Partly — the wiring checklist can be a scheduled assertion; the end-to-end path needs a real PR.