[TheGreatAxios]

Part of CL-11525. First of five stacked PRs that remove the old pr-triage path. This one changes routing only: every pull request now goes through the host's listener. Later PRs delete the code this leaves unused.

Why

Before this change, a workspace without a live listener could still triage through the old pr-triage workers, the backlog workflow and the PR workflow variants. That kept two paths alive, each with its own fallbacks. Now there is one path, and Upgrade is how a workspace gets onto it.

What changed

• Webhook mail, the reconciler's catch-up, Triage again, approving a held Do, and backlog triage all go to the host's listener. If no listener is live, nothing runs:
  • Triage again, approvals and backlog triage answer 503 service_not_running, naming the listener and saying to upgrade in Settings.
  • A webhook's head fails with the listener's name.
  • The reconciler skips the workspace with reason no_listener.
• The reconciler no longer replaces or redeploys pr-triage deployments. Rotation, heal and their settings are removed: TRIAGE_ROTATE_AFTER_RUNS, its docs, and the heal test.
• Review again now records a pull request mail for the current head with code review switched on, for everyone, on any verdict. The manager then deploys the review. This also works in a repository whose policy file decides code review. The "policy file decides" refusal on Review again is gone; the switch still refuses.
• The PR workflow router is replaced by a small gate in front of every pull request mail:
  • On GitHub, the pause label still stops a run.
  • A policy file that writes its own decide has approve and merge taken out of automatic, so they wait in Needs you. Nothing on the listener path carries out decide.
• The held-Do refusal "Code review held this action…" is gone, because approvals no longer go to a variant.
• Every pull request a mail names passes the pause gate and the decide hold at intake, so webhooks, the reconciler, Triage again, Review again and backlog triage are all gated the same way.
• Review again tags its mail with an again id. The manager deploys one more review of the head for each new id, even after an earlier review of that head has settled. The review it deploys records the id.
• Backlog triage works on Bitbucket Data Center too, through the listener's open-pull-request listing.
• With no listener, every refusal and a failed head's reason say that Triage is stopped on that host until someone presses Upgrade to new version in Settings. Settings says the same thing.
• The standalone code review feed sends nothing. Slice 2 deletes it.
• Slice 2 also deletes the rotation leftovers, the coordinator's triage lane, the triage branch of failCoordinatedJob and readyWorkerCredentials.
• ARCHITECTURE.md, the route docs and the user manual are updated to match.

Verified

• bun run check, bun run lint and the policy check pass.
• Hub tests for the reconciler, Triage again, held Dos, the pause gate, the coalescer, code review and Review again pass. New tests cover:
  • a host without a listener being skipped;
  • Triage again and held-Do approval answering 503 without a listener;
  • Review again sending a forced code-review mail through the listener.
  • Each intake entry point (catch-up items, a single mail, backlog) being gated.
  • A manager deploying one more review for a Review again on a settled head.
  • A Bitbucket backlog going to the listener.
• Not verified live: Review again against a running manager.

[linear-code]

CL-11525