chore: migrate to the channel-aware agent policy workflow

[willgriffin]

Closes #124. Refs happyvertical/have-config#228 step 4.

This repository ran the generation-6 bridge shape of
.github/workflows/agent-policy.yml, which reads vars.AGENT_POLICY_ARTIFACT
directly. It could not follow the protected policy channel, so it had to be
repinned by hand every generation — and silently ran a stale artifact from
2026-07-21 until 2026-07-25, when a manual repin moved it to generation 10.

The channel-aware workflow resolves the artifact from the protected channel state
in happyvertical/.github at run time. The repository now follows stable
automatically and cannot go stale at the next generation.

Contents

Generated by hv-agent migrate-repo --profile happyvertical --apply:

• .github/workflows/agent-policy.yml — channel-aware resolution
• AGENTS.md — managed policy block refreshed for generation 10
• .agents/project.yaml — jcode/kimi dispatch labels the profile now defines

Follow-up after merge

Delete the AGENT_POLICY_ARTIFACT repository variable. The new workflow never
reads it, so leaving it in place is dead configuration that will mislead the next
reader. I'll do this once this lands.

Why this was blocked until now

The migration preflight required the trusted policy lock to match the source
generation, and every required repository to have a current default-branch canary
proving the active channel. The lock sat at generation 7 while the control plane's
main moved on, so the preflight refused — happyvertical/have-config#238.
Generation 10 was promoted to stable on 2026-07-25 and fresh canaries were
dispatched across the required fleet, clearing both conditions.

Validation

hv-agent audit passes clean against generation 10.

{
  "schema": "hv-agent-run:v1",
  "runtime": "claude-code",
  "session": "hv-migrate-ocr-124",
  "issue": 124,
  "linked_issue": 124,
  "policy_revision": "1.0.0",
  "status": "complete",
  "validation": ["hv-agent audit: policy audit passed against generation 10", "hv-agent migrate-repo preflight cleared"]
}

[github-actions]

Version Bump Preview

When this PR is merged, @happyvertical/ocr will receive a patch version bump based on your conventional commits.

What happens on merge?

1. Tests run on main branch
2. Package is built
3. Version is bumped automatically
4. Package is published to npm
5. Git tag is created

No manual intervention needed!