fix(pr-pipeline): arm lane pull requests reliably and say on each why it stays unarmed

.changes/pr-pipeline/agent-ab0dff723afdb6f4c-77b6478d.md

@@ -0,0 +1,8 @@
+---
+bump: patch
+---
+
+### Fixed
+
+- pr-merge's enable-auto-merge job no longer fails its arm with `fetch failed` after a long verifier read. Every request now sends `Connection: close`, so none goes out on a pooled keep-alive connection that sat idle while the verifier ran and that GitHub had closed. A GraphQL request that still fails on the network (Node's "fetch failed", or a cause code of `ECONNRESET`, `ETIMEDOUT`, `UND_ERR_SOCKET` or `UND_ERR_CONNECT_TIMEOUT`, or "other side closed") is sent up to twice more (a REST write, such as the refusal comment, never is), after full-jitter waits capped at 4 s and then 8 s. An HTTP error answer or a GraphQL error is not sent again. A resent arm passes the same `expectedHeadOid`, so it arms only the head the run read. A pull request whose arm or disarm still fails is left as it was and named with the error's cause code and message, with any token scrubbed. The run then goes on to the other pull requests and exits 1.
+- A lanes App pull request that native auto-merge leaves unarmed no longer sits with only an Actions log line to say why. On a scheduled or hand-started run, a refusal on a hold path, a cost path, the gate's verifier verdict or its risk score is written on the pull request in one `<!-- babysit-merge-risk -->` comment that names the head and the reason. The comment is edited in place when the reason changes, and left alone while it does not. A refusal a person must clear also gets the human-gated label: a hold or cost path, an issue link the lane does not take, a verdict the gate marks `needsHuman`, or a risk hold that has stood unchanged for `merge.risk-escalation-minutes`. That comment carries the attended queue's escalation marker. A refusal the lanes clear on their own, such as a missing verdict, gets the comment only. A label a person removes stays off until the reason or the head changes.