✨ automerge: route self-merge sweep, lgtm queue and hive-merge relay through the serialized lane; skip native merge-queue branches #10889

Part of #10884

Make all three merge paths consult the serialized lane gate for hive-serialized repositories, and leave branches that have GitHub's native merge queue alone. For direct repositories the paths take exactly today's code path, decided from configuration alone.

Requirements (parent Proposed design, Current behavior #1–3, Interaction with GitHub native Merge Queue → MVP, The spec R3, R7, R22)

• R7. No Hive merge into a hive-serialized repo unless the PR is at the front and passed the final re-check — whichever path asks: the App's self-merge sweep (trySweepSelfAuthoredPR), the human-approved lgtm queue sweep (trySweepQueuedPR), and the hive-merge relay. Any other request is deferred with reason "not at the front of the lane". Each path keeps every gate it applies today (authorization, trusted merger, intent tier, approval desk, merge-eligible list, required review approval, min_head_age, the relay's positive-evidence CI gate); the lane only adds. Each path supplies its own "authorization still holds" callback for the final re-check (e.g. lgtm approval still matches the head).
• The sweep's auto_merge.max_merges loop (parent Current behavior ✨ Add macOS/launchd support, hybrid scanner pattern, and KubeStellar case study #3) must not merge two PRs into the same lane branch in one pass from one validation (Inv. 7).
• R3 / AC4. Strategy never enables merging: auto-merge off, paused, below Level 6, or held ⇒ no merge from any path.
• R22 / AC26. If the target branch has GitHub's native merge queue (detector from ✨ github: lane-only branch-rules reader (ruleset required checks, up-to-date enforcement, native merge-queue detection) #10887), the lane does not run for it and Hive makes no direct merge into that branch; the refusal reason says why (shown in the dashboard by the lane-view child).
• Agents gain no new way to merge; the lane runs inside the Hive process.

Acceptance criteria (from parent)

• AC1. No strategy set anywhere ⇒ two green PRs into one branch behave exactly as today.
• AC2. In the existing sweep / lgtm queue / relay tests, a direct repo produces the same GitHub calls, same order, same parameters; deciding direct needs no GitHub call.
• AC4. As above.
• AC6. Two green eligible PRs into one branch: ≤1 in final validation; the second merges only after the first merged and the second was updated and re-passed on the new tip.
• AC7. For a non-front PR: sweep makes no merge call; relay request and lgtm PR are deferred with "not at the front of the lane".
• AC26. Merge-queue branch: no direct merge, reason recorded.

Code locations (parent Current behavior table / Likely code areas)

• pkg/github/automerge/automerge_sweep.go:1097, :1365, :182, :705-792, :1097-1100, :1519
• pkg/github/merge_request_watcher.go:346, pkg/github/merge_ci_gate.go, pkg/github/pullrequest.go:273
• cmd/hive/merge_eligibility.go:107-113; wiring in cmd/hive/main.go (sweep start, run-loop queued sweep)
• policies/scanner-automerge.md (tell the scanner a deferred "not at the front of the lane" is expected, not an error)

Blocked by #10888 (lane core).

Definition of Done

• Single strategy == hive-serialized branch point per path, before any lane-specific GitHub call.
• Sweep, lgtm sweep and relay route through the lane gate; non-front requests deferred with the stated reason.
• Native-merge-queue branches refused with reason.
• New scenario tests for AC6, AC7, AC26, AC4; existing path tests pass unchanged (AC1/AC2).

Non-negotiable invariant

Nothing changes for organization repositories or repositories left on direct. Every merge path decides and merges exactly as today, makes the same GitHub calls (same order, same parameters) and gives the same refusal reasons; deciding a repository is direct needs no GitHub call (parent AC1, AC2, Constraints). Existing tests for the self-merge sweep, the lgtm queue, the merge-request relay, merge eligibility and required checks must pass unchanged. No existing gate is weakened on any path. The lane must never be called a "merge queue" in code, config, dashboard or docs.

Out of scope

Fixing items 4–7 of the parent's Current behavior table on the direct paths (stale behind detection, ruleset checks on default paths, live labels in the sweep's last re-check, unpinned branch updates) — the parent's MVP → Deferred and Decisions already made #9 keep those as separate issues. Also deferred: auto/native, merging through GitHub's queue, synthetic merge refs, batching, per-branch strategy, rebase updates, automatic revert, two hives on one repository.

Target branch: v6. Paths are under src/.

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88