ci: add a maintenance watch that notices unattended work

[moshest]

Why

The scheduled agent sweep set up for this has been firing into nothing for a week.

create_trigger only accepts a prompt, schedule and environment — it has no parameter for repository sources, and the creating session had no connectors to pass on. Compare the stored config against the content-agent Routine, which works:

	content agent	the sweep
sources	neuledge-internal	none
connectors	Gmail, Calendar, Vercel	none
created via	http_api	meta_mcp

So every morning a session woke with sweep instructions, no repository checked out and no GitHub tools, and correctly did nothing. Silently — which is the worst way for a watchdog to fail. Two contributor PRs (#125, #126) sat unanswered for two days while it reported nothing wrong.

What this does

The detection half, in CI, where GITHUB_TOKEN is native and there's no session plumbing to inherit. Three checks, each for something that has already gone wrong in this repo:

• Open PRs with no non-bot comment after two days — the failure above.
• The last seven scheduled registry-update runs, not just the latest. A failure can vanish on its own when --since 2 stops selecting the broken version, turning the run green while the cause remains. That's precisely how the sanity breakage hid for four nights, and the check says so explicitly when the latest is green but earlier runs failed.
• package.json version vs npm dist-tags. A changeset can merge and never publish — which once left a security fix in main looking shipped.

Findings go to a single tracking issue that updates in place and closes itself when everything clears. It never touches code.

Honest limitation

The GitHub API is unreachable from the environment I wrote this in (403 through the proxy), so the API-dependent paths could not be exercised before merge. Only the npm check ran end-to-end (local=1.2.3 npm=1.2.3, correctly no drift).

That shaped the design: every response is shape-checked, and an unexpected one fails the job. A red run is a visible alarm; a watchdog that reports "nothing outstanding" because a call failed is worse than no watchdog at all.

What I could verify locally:

• YAML parses; steps, permissions and schedule resolve as intended
• Both run blocks pass bash -n
• Clean path exercised with stubbed API responses — exits 0 with empty findings
• Fixed two set -e traps found in review: [ -n "$stale" ] && … and [ "$age" -lt 2 ] && continue both exit non-zero when the condition is false, which would have failed the job on a healthy repo
• Fixed a YAML break where a heredoc body sat at column 0 (and its --- line was a document separator)

First scheduled run is 07:20 UTC; workflow_dispatch is enabled to trigger it sooner.

Not included

Review judgment still needs an agent session — there's no Claude action or API credential in this repo. This closes the gap that actually bit us: nothing was noticing.

---

Generated by Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: 4e17bd0

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR