[Pavel Feldman (pavelfeldman)]

• roll.yml takes the shape of triage.yml: the shared run-agent runs the session and the shared publish-patch opens the PR. A partial roll still opens as a draft, and a complete roll is marked ready.
• The needs-roll label on an issue starts a roll to the tip of main. The bot posts the run link on the issue, then the result, and the PR says Fixes <issue>. A run started by hand still takes a ref.
• setup-triage-runner takes an optional pin. With it, the action pins the commit, updates NODE_VERSION and generates the API before it builds. Triage and revision do not set it.
• The roll-specific path checks stay in the publish job. They now read the patch in a separate index, so the checkout stays clean for publish-patch.
• The concurrency group is on the roll job: every issue label starts the workflow, and a skipped run would replace a roll that waits.