feat(kanban): nightly drift reconciler + per-repo .kanban.yml override

[LukasWodka]

Summary

Two enhancements to harden the kanban automation against silent stalls — catches the failure modes that produced the ≈109 items we hand-swept today.

1. kanban-reconcile.yml — nightly drift reconciler (new)

Cron at 04:00 UTC daily scans non-terminal columns (Code review, FR on dev, Ready for staging, FR on staging, Ready for prod) and self-heals four classes of drift:

Class	Action
Merged PR, SHA on repo's prod branch	→ Prod (drift-to-prod)
Merged PR matching ^(Release|Dev to staging|Staging to prod) pattern	→ Prod (release-vehicle)
Closed-not-merged PR in any non-terminal column	→ Cancelled (cancelled)
Open issue in a post-merge column	→ Backlog (misplaced-issue)

Safety net: aborts if any single run would move > 100 items (treats that as a bug, not real drift). Supports workflow_dispatch with dry-run: true for safe testing.

2. advance-deploy-env.yml — .kanban.yml per-repo override

For repos where the default branch isn't the prod-truth (e.g. averaging-service ships Docker images from staging without ever pushing main), drop a .kanban.yml at the repo root:

# averaging-service/.kanban.yml
branch_status_map:
  staging: Prod

The override merges with the default mapping. This was the root cause of 19 averaging-service items getting stuck in Ready for prod today — main was never pushed because the deploy convention doesn't require it.

Why now

Cleanup audit this session moved ~109 items from Ready for prod / FR on staging to Prod (or Backlog for misclassified open issues). Every move fit one of the four patterns above. With this reconciler running nightly, the next time something silently drifts it'll be auto-healed within 24 hours instead of accumulating for weeks.

Diagnosis details in the conversation log; key root causes that still bite without this PR:

• advance-deploy-env silently crashed for weeks before the -F→-f fix landed (fix: pass kanban option IDs as raw strings (-f not -F) to survive numeric IDs #52); items in flight when the bug hit never moved.
• Repos that deploy out-of-band (averaging-service today, maybe others tomorrow) have no automation path at all without .kanban.yml.

Test plan

• Merge to develop; let the natural develop → main promotion carry it up.
• First scheduled run (next 04:00 UTC after main merge) should report planned: 0 since today's cleanup left RfP / FR-on-staging empty.
• Trigger one manual run with dry-run: true from the Actions tab to confirm classification logic before relying on auto-apply.
• Once confirmed working, drop a .kanban.yml into averaging-service to lock in the staging: Prod convention.

Follow-ups (separate PR)

• Layer 2 — stuck-in-column nudge bot (weekly Monday Slack report on items idle past per-column thresholds).
• Once .kanban.yml is in averaging-service, the next staging push will auto-advance items to Prod and the reconciler becomes a backstop, not the primary path.

🤖 Generated with Claude Code

[LukasWodka]

👋 Heads-up — Code review queue is at 12 / 8

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#98 — ci: add fr-gate caller workflow · author: @LukasWodka · no reviewer assigned
• client#191 — fix(#190): fail image-refresh loudly when the ingestor (ghcr) digest can't resolve · author: @saadqbal · no reviewer assigned
• client#192 — Simplify install: drop data-plane PriorityClass + fixed namespace + one-per-machine guard · author: @LukasWodka · reviewer: @saadqbal
• data-ingestors#146 — test(schema): lock category enum to the engine's TaskCategory (anti-drift) · author: @LukasWodka · reviewer: @saadqbal
• data-ingestors#148 — Develop to prod · author: @divyasinghds · reviewer: @saadqbal
• design-system#19 — fix: un-track coverage/ and node_modules/ from git · author: @LukasWodka · no reviewer assigned
• design-system#22 — ci: add Vitest test workflow · author: @LukasWodka · reviewer: @aptracebloc
• design-system#23 — ci: add fr-gate caller workflow · author: @LukasWodka · no reviewer assigned
• frontend-app#499 — ci: add Vitest + Cypress test workflow · author: @LukasWodka · reviewer: @aptracebloc
• model-zoo#77 — ci: add fr-gate caller workflow · author: @LukasWodka · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)