security(ci): neuter Inbox Steward auto-merge (owner directive: never auto-merge)

The Inbox Steward workflow auto-merged PRs with no human in the loop, in
three ways that violate the standing 'never auto-merge security/dep PRs'
rule:
  1. a */15-minute schedule cron ran it unattended;
  2. TRUSTED_AUTHORS='hyperpolymath|dependabot|renovate' let those authors'
     PRs squash-merge with ZERO approvals (so the owner's own PRs, and
     dependency PRs, auto-merged unreviewed);
  3. the auto-merge job ran whenever candidates existed.

Neutered surgically, monitoring/dispatch jobs preserved:
  - removed the */15 autonomous cron (no unattended runs);
  - removed the trusted-author approval-bypass (IS_TRUSTED=false -> a real
    approval is always required);
  - gated the auto-merge job behind a default-OFF opt-in
    (vars.INBOX_STEWARD_AUTOMERGE == 'true'); until set, it never merges.

identify/validate/dispatch-to-hypatia/summary still run for MONITORING.
Found by the fleet auto-merge audit (dev-notes/2026-06-16-fleet-auto-merge-audit.md),
which also flags two other auto-merge paths (robot-repo-automaton GraphQL
auto-merge; fleet-coordinator.sh:711) for a follow-up decision.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/inbox-steward.yml

@@ -42,10 +42,10 @@ on:
         required: false
         default: 'false'
         type: boolean
-  # Scheduled sweep
-  schedule:
-    # Every 15 minutes
-    - cron: '*/15 * * * *'
+  # NEUTERED 2026-06-16 (owner directive: never auto-merge security/dep PRs).
+  # The */15 autonomous sweep cron was removed so this workflow no longer runs
+  # unattended. It still runs on PR/review/check events and workflow_dispatch for
+  # MONITORING; the auto-merge job itself is gated OFF by default (see below).
 
 permissions:
   contents: write
@@ -219,10 +219,13 @@ jobs:
               "repos/${{ github.repository }}/pulls/$PR_NUM/reviews" \
               --jq '[.[] | select(.state == "APPROVED")] | length')
             
-            # Check 6: Author is trusted or has approval
+            # Check 6: Approval is REQUIRED.
             AUTHOR=$(echo "$PR" | jq -r '.user.login')
-            TRUSTED_AUTHORS="hyperpolymath|dependabot|renovate"
-            IS_TRUSTED=$(echo "$AUTHOR" | grep -E "$TRUSTED_AUTHORS" && echo "true" || echo "false")
+            # NEUTERED 2026-06-16 (owner directive: never auto-merge without human
+            # review). The trusted-author approval-bypass (hyperpolymath|dependabot|
+            # renovate merging with ZERO approvals) is removed: no author bypasses
+            # the approval requirement.
+            IS_TRUSTED="false"
             
             # Validate
             ALL_CHECKS_PASSED="true"
@@ -280,7 +283,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     needs: validate-prs
-    if: needs.validate-prs.outputs.auto_merge_candidates != '[]' && inputs.dry_run != 'true'
+    # NEUTERED 2026-06-16 (owner directive: security/dep PRs are manual-review only).
+    # Auto-merge is gated behind an explicit, default-OFF opt-in. Until the repo
+    # variable INBOX_STEWARD_AUTOMERGE is set to 'true', this job NEVER runs and
+    # nothing is auto-merged. Re-enable deliberately, and only with human-gated review.
+    if: vars.INBOX_STEWARD_AUTOMERGE == 'true' && needs.validate-prs.outputs.auto_merge_candidates != '[]' && inputs.dry_run != 'true'
 
     steps:
       - name: Checkout gitbot-fleet