ci(town-crier): resolve on unlabel — de-announce when the review label is removed

[jasperboerhof]

What

Makes the town-crier producer workflow de-announce a PR when its Agent Review Requested label is removed, not only when the PR closes/merges.

Four edits to .github/workflows/announce-pr.yml:

1. Trigger types — add unlabeled ([labeled, closed] → [labeled, unlabeled, closed]).
2. resolve: job if: — fire on closed-with-label OR unlabeled-of-Agent Review Requested.
3. resolve step — add ACTION env, and branch the resolve NOTE (review label removed / merged / closed without merge).
4. Header comment — amended to mention label removal alongside close/merge.

Announce side is unchanged.

Why

The producer only de-announced on close, and that close-resolve required the label to still be present — so unlabel-then-merge left the request stranded "open" on the town-crier bus forever (there is no GitHub→bus merge sync). Removing the label now immediately POSTs /resolve. The bus no-ops an unknown pr_url, so the call is always safe.

Verification

• python3 -c "import yaml; yaml.safe_load(open('.github/workflows/announce-pr.yml'))" → YAML OK
• CI here is the PHP gate suite (composer audit / format:check / phpstan / test:coverage / coverage:check / mutation:ci); none analyze .github/workflows/, so no workflow linter to run locally.

Deviations from kendo

None — this is a town-crier producer workflow, not a kendo-pattern port.

[Goosterhof]

The unlabel guard lands correctly: resolve's if: keys the new branch on github.event.action == 'unlabeled' && github.event.label.name == 'Agent Review Requested' (.github/workflows/announce-pr.yml:60). On the unlabeled action github.event.label is the label just removed, so a wip/priority removal can't false-resolve a still-open thread — the failure mode this whole change had to avoid.

on: adds unlabeled without dropping labeled/closed (:25), so announce and close-resolve are intact. The new ACTION env is github.event.action (a fixed GitHub enum, not attacker-controlled) consumed quoted as "$ACTION"; NOTE branches to string literals — no label name reaches a run: shell, so no injection vector despite unlabeled being a label-driven event. permissions: {}, pull_request (not _target), and the loud-config-error / tolerant-curl fail-open all survive the addition. CI green (8.4/8.5/announce pass, resolve correctly skips).

Description matches the diff. Approve.

Automated war-room agent review — posted because this PR carries the Agent Review Requested label.