[dsyme]

Summary

Replace Repo Assist's whole-run scheduled PR-cap gate with maintenance-only mode. At eight open [repo-assist] PRs, the old activation check stopped everything—including Task 6, which maintains existing PRs. This was observed in fsprojects/Paket's October 17 run.

• Remove the activation-time count/failure gate.
• At capacity, deterministically select Tasks 6, 1 and 2; prohibit new PRs while retaining existing-PR maintenance, labelling, investigation, memory and activity reporting.
• Below capacity, expose the available new-PR slots to the agent.
• Before scheduled safe outputs are applied, recount all live open PRs and reject creation batches exceeding the eight-PR cap. Maintenance-only batches do not depend on another capacity API call; API failures during a creation check fail explicitly rather than becoming zero PRs.
• Preserve manual/command-mode exemptions, paginate PR reads, and update the user documentation.
• Add 12 dependency-free regression tests and run them in CI.

This branch is independently based on main, not stacked on the separate output-consistency change.

Validation

• python3 -m unittest discover -s tests -p 'test_repo_assist_*.py' -v: 12 passed.
• gh aw compile workflows/repo-assist.md --approve: passed with gh-aw v0.93.3; freshness reports Yes.
• Shellcheck passed for the changed run scripts.
• Checked generated YAML: agent remains read-only; capacity guard precedes process_safe_outputs and is schedule-only.
• git diff --check: passed.
• No agent workflow was manually dispatched; actual hosted agent execution remains untested. Hosted regression-test results are below.

The compiler reports ten warnings in its generated scaffolding (including undeclared admission outputs and persisted-checkout credentials). They are not suppressed here. Sample workflows/*.lock.yml files are intentionally ignored in this repository, so the regenerated lock is validated locally rather than force-added. Shared action-cache churn was excluded.

Compiler compatibility / security review

Compilation with the current release required removing the unsupported native Copilot web-fetch entry and normalizing request_review to request-review. Existing allowed networking and shell tools remain available; no agent write permission is added.

The new authored action use is actions/download-artifact@v8, resolved by compilation to 9000827ccba6bdab643e8b6fd33ac0654aef8333 (v8.0.2), whose tag was verified. The generated setup pin is gh-aw-actions v0.93.3 (e89a5670dc4c790b37ade361215b8d72d8ce8942), also verified. No new secrets or redirect changes. GH_TOKEN uses the existing GitHub token only for read-only API calls. The guard parses JSON artifacts; it does not execute their contents. The existing memory validator is unchanged; the current compiler's newly recorded validator approval was reviewed.

Hosted CI result

CI run 40114441375 ran all 12 new regression tests successfully. The subsequent repository-wide compile failed on unchanged .github/workflows/daily-repo-goals.md and .github/workflows/link-checker.md, whose native tools.web-fetch entries are rejected by the latest compiler. Neither file is modified by this PR. The updated Repo Assist template compiles successfully in focused local validation. This unrelated compatibility upgrade is intentionally not bundled here.

Companion independent PR: #406.