Run the lifecycle auditor as a read-only GitHub check #467

Parent

#455

What to build

Add the GitHub Actions entrypoint for the read-only lifecycle auditor after #458 lands. The workflow exposes one stable check and invokes the existing auditor without duplicating its policy logic or mutating issue, pull-request, label, or repository state.

Acceptance criteria

• Pull-request runs expose the stable non-required check name Issue Lifecycle Audit for opened, edited, reopened, synchronize, and ready-for-review events.
• Scheduled and manual runs audit the live repository and publish the result to the GitHub step summary.
• The workflow invokes the auditor from Audit issue hygiene and PR closure semantics without mutation #458 instead of reimplementing lifecycle rules in YAML.
• Permissions are read-only and limited to the repository contents, issues, and pull requests required by the audit.
• Every third-party action is pinned to an immutable full commit SHA.
• Focused workflow-contract checks prove the event set, permissions, pinned actions, stable check name, and summary behavior.
• The workflow can be merged and rolled back independently from required-check enforcement.

Blocked by

#458 must merge first.

Out of scope

• Publishing the authoritative Issue Lifecycle PR-head status after linked-issue edits; that remains Invalidate stale lifecycle status after linked issue metadata changes #480.
• Adding Issue Lifecycle to branch protection; that remains Enable the Issue Lifecycle required check after a green observation window #460.
• Historical metadata reconciliation; that remains Reconcile existing GitHub issue metadata against the lifecycle contract #459.
• Any issue, pull-request, label, branch-protection, or repository-setting mutation.