feat(gh-aw): add scheduled and evidence-triggered retrospectives - #2005

Booster — CI/CD Review of PR #2005

Verdict: APPROVE

Deep-reviewed the full diff against dev (22 files), the compiled workflow surface, permissions, triggers, concurrency, and dedup/cooldown/pending-request-recovery logic in squad-retro-evidence.mjs.

What I verified directly (not just trusting CI green)

• Compiled squad-retro.md myself with gh aw compile --strict (same technique CI's gh-aw-compile job uses). It compiles cleanly to a valid squad-retro.lock.yml with no warnings once run with repo remote context.
• Cron strings: the unresolved review thread from copilot-pull-request-reviewer[bot] claims the schedule strings are invalid GitHub Actions cron and will fail to trigger. This is a false positive - gh-aw's documented "friendly schedule" syntax (the exact string used in gh-aw's own schedule-syntax docs) resolves these at compile time to valid 5-field cron. My local compile confirms it: emitted "26 2 * * 1" and "15 */6 * * *" with "Friendly format" comments. No fix needed.
• Permissions: top-level permissions: {} with per-job scoping (agent job: read + copilot-requests: write, no issue/PR write; upsert_retro_state job: issues: write only, no PR write). This is the correct least-privilege split and matches the pattern used by other framework-generated jobs already in dev (compared against the compiled squad-review.lock.yml).
• Bounded outputs: create-issue max 6, add-comment max 8, add-labels max 18, all with require-temporary-id/allowed label lists - consistent with the "Bounded actions, at most five issues" prose plus one for initialize_state.
• No infinite-loop surface: squad-retro.md declares no dispatch-workflow safe output - it is a terminal receiver. Only squad-review (max 1, REQUEST_CHANGES only) and squad-implement-worker (max 3, persistent-failure only) may wake it, and both delegate the actual eligibility decision to the deterministic gate rather than deciding themselves.
• Dedup/cooldown/pending recovery: evaluateRetro() in squad-retro-evidence.mjs fails closed on incomplete pagination or log truncation, preserves truncation_preserved_fingerprints as pending rather than resolving on missing evidence, requires an Action-Key match before opening a new action issue, and gates the durable state comment behind trusted-origin checks (bot author, open, correct label) before upsert. test/gh-aw-retro-workflow.test.ts has 46 targeted cases covering exactly these paths (threshold, cooldown expiry, legacy in-flight recovery, truncation fail-closed, low-confidence exclusion).
• Router/authorization: /squad retro was correctly added to workflows/squad.md's authorization-required mode list (write/maintain/admin gate), not left as an open command.
• Checks: all 18 applicable status checks pass against the current head SHA 4633a87 (gh-aw strict compile, security review, architectural review, tests, policy gates, changeset drift, etc.). mergeStateStatus is BEHIND but MERGEABLE - the 5 commits ahead on dev are unrelated dependency bumps.

Non-blocking notes

• One open (unresolved) review thread from the Copilot reviewer bot re: cron syntax - recommend replying with the friendly-schedule compile evidence above and resolving it, since it is not accurate for this codebase's pinned gh-aw compiler.
• Branch is BEHIND dev by 5 commits (dependency bumps only); update-branch before merge is routine, not a blocker.

No blocking findings. Approving.