feat(pr-pipeline): hold lanes App human-merge pull requests with a label only a listed human can remove #9437

Refs: #9399

Problem

A lanes App pull request's "a person merges this" decision lives in text the lanes App can edit. The App has pull-requests: write, so a lane run could delete the Hold: line report-outcome writes for a human-merge pull request, or rewrite its Refs: #N first line to Closes #N. enable-auto-merge.mjs would then arm it on the next run, and ci-status's lanes App hold step (merge-holds.mjs) would pass, because both read the same live body. The do-not-merge label is the enforced hold today, and a body Hold: line is advisory. Hold paths and a trusted approval of the head still bind the App on denied paths.

Proposal

When report-outcome opens a human-merge pull request, give it a label that only a person on the trusted-actor list can remove. Reuse the needs-human lift step in ci-status (Fail a review-lane hold an untrusted account lifted) so removal by any other account fails ci-status, and have arm time skip any pull request that carries the label. Cover both cases:

1. The Hold: line is removed from the body.
2. Refs: #N is rewritten to Closes #N.

Acceptance

• A human-merge lanes App pull request carries the label from opening.
• Neither body edit arms it, and ci-status stays red until a listed human removes the label.
• Tests pin both cases.