[Governance] Align scheduler merge modes and mutation credential authority

[seonghobae]

Problem

Protected-main policy prefers GitHub Actions for mechanical updates/merges and describes exchanged OpenCode App-token merges as deprecated, but the scheduler still selects the exchanged App token in its mutation credential chain. Separately, direct_or_auto behavior and prose do not have one machine-checked definition for blocked/clean/behind/conflicting states. Identity labels, credential selection, and merge-mode decisions can therefore drift.

Required contract

Review publication, branch mutation, merge, release, and deployment authority remain distinct. Each scheduler state has one explicit allowed action and credential class; no prose-only deprecation or implicit fallback is accepted.

Acceptance criteria

• Publish a decision table for merge state, review/check/thread state, head capability, merge mode, and allowed action.
• Define the exact ordered credential chain per same-repository and cross-repository action.
• Either remove App-token mechanical mutation or document, scope, test, and audit it as an accepted fallback through an ADR update.
• BLOCKED, DIRTY, CONFLICTING, stale-head, missing-authority, and policy-denied states cannot reach an unintended direct merge.
• Every merge uses final expected-head protection and GitHub ruleset enforcement.
• Tests assert actor class, token-source telemetry, fork/cross-repository behavior, each merge mode, and rollback.
• Protected-main consumer evidence proves the selected actor and state transition.

Related work

Counted reviewer independence remains tracked in #772; snapshot/live-base binding remains tracked in #840.