Orchestrator skips quality gate when label exists but approval was dismissed

[microsasa]

Problem

The orchestrator checks for the aw-quality-gate-approved label to decide whether to dispatch the quality gate. But this label can persist even after the approval review is dismissed, causing the orchestrator to skip the quality gate when it's actually needed.

Root Cause

Branch protection has dismiss_stale_reviews: true. When a new commit is pushed (e.g., by the responder or ci-fixer), GitHub automatically dismisses all existing approvals — including the quality gate's APPROVE review. However, the aw-quality-gate-approved label is NOT removed, so the orchestrator sees the label and says:

✅ PR #177: Already quality-gate-approved. Auto-merge should handle it.

But auto-merge is BLOCKED because the actual approval was dismissed.

Observed Behavior (PR #177)

1. Quality gate approved PR fix: populate active_* fields for pure active sessions (#154) #177 and added aw-quality-gate-approved label
2. Responder pushed fix: address review comments commit
3. GitHub dismissed the quality gate's approval (stale review)
4. Orchestrator ran, saw label, skipped quality gate dispatch
5. PR stuck in BLOCKED state — no valid approval, auto-merge can't proceed

Possible Fixes

Option A: Orchestrator checks actual review state, not just label

• Query reviews for a non-dismissed APPROVE from github-actions[bot]
• Only skip quality gate dispatch if a valid (non-dismissed) approval exists

Option B: Agents remove label when pushing

• Responder and ci-fixer remove aw-quality-gate-approved label when they push new commits
• Orchestrator logic stays the same

Option C: Both

• Agents remove the label on push (belt)
• Orchestrator verifies actual approval state (suspenders)

Option C is most robust — the label becomes a hint, not the source of truth.

Related

• bug: cron schedule trigger skipped — missing from orchestrator if: condition #175 — premature quality gate checks
• perf: rewrite pipeline orchestrator as regular GitHub Action (yml) #135 — pipeline orchestrator tracking issue