[needs:evolver] Auto-merge + re-trigger must be deterministic and correctly scoped (actions:write, --ref); not an LLM prompt

[the-gigi]

The auto-merge workflow's orchestrator re-trigger lived inside the LLM prompt and (a) was dropped when the agent hit max-turns, and (b) the token had workflows:write but not actions:write (which gh workflow run needs), and gh workflow run without --ref fails a default-branch lookup. Net: the loop stalled after a successful merge.

Found on MaKlaude. Fixes proven in bc5c0b9 (push-trigger token + --ref main) and bc8efc4 (move re-trigger to a deterministic if: always() step + actions:write).

Also: merging green bot PRs is mechanical — per deterministic over agentic, the merge itself should be gh pr merge --squash gated on author+checks, not a claude-code-action prompt. Relates to permission issues #14/#5.

[the-gigi]

Third failure observed in this path on MaKlaude (after re-trigger fragility): auto-merge starvation via a shared concurrency group. genesis-merge.yml shared the orchestrator concurrency group, so a CI-Failure-Triage (or orchestrator) run already in the group cancelled the Auto-Merge run that fires on a green PR — the PR went green but never merged, stalling the milestone. Fix proven on MaKlaude (913f8ff): give auto-merge its own group (genesis-merge-${{ github.repository }}). Merges only need to serialize among themselves; a server-side squash-merge running alongside an orchestrator is harmless. So the auto-merge path needs all three: deterministic re-trigger (if:always), correct token scopes (actions:write + --ref), and its own concurrency group.