The owner-review label default is resolved in Go #930

Problem

dt_owner_review_label in packages/agents/source/lib/agent.sh still decides in shell which label marks a pull request as waiting for the owner's review: the configured owner_review_label, or the default. The persistent review bounds, lint selection, the configuration digest and the reporting transport are owned by #770, the context discovery checks by #755, and the default-branch selection behind dt_policy_ref by #763. The unattended commit context (dt_commit_context, dt_commit_merge_head) and packages/agents/source/lib/worktree-ready.sh belong to the commit-skill area, children 01 and 02 of #322. This issue ports only the label default that those leave.

Part of #588 and #321. Replaces dt_owner_review_label in packages/agents/source/lib/agent.sh.

Acceptance criteria

1. AC1: Given owner_review_label unset in repository configuration, when the label is needed, then it is owner-review.
2. AC2: Given owner_review_label set to a valid label name, when the label is needed, then that name is used.
3. AC3: Given owner_review_label set to an empty value, when the label is needed, then the call refuses with a diagnostic naming the key.
4. AC4: Given a consumer binary that lacks the replacement, when the wrapper runs, then it falls back to the frozen shell behavior and the N-2 compatibility policy holds; and given a present replacement that fails or returns unusable output, then the workflow refuses with no fallback to the shell.
5. AC5: Given the generated skills, when mise run generate-skills runs, then the output is regenerated from the canonical sources, mise run check-generated-skills passes, and the local deployments carry the regenerated wrappers.
6. AC6: Non-functional: the Go tests pass on Linux, macOS and Windows in CI.

Scope and non-goals

Scope: the owner-review label default and its wrapper.

Non-goal: dt_commit_context, dt_commit_merge_head and worktree-ready.sh, which children 01 and 02 of #322 own. Non-goal: review bounds, lint selection, the configuration digest and reporting (#770). Non-goal: the in-progress and detached checks shared with other workflows (#755), default-branch selection (#763) and the GitHub command boundary (#760). Non-goal: removing the shell fallback.

Approach

Meet AC1 to AC6 with failing cases first. The mechanism is the implementer's choice within those outcomes.

Dependencies

Blocked by: #753 (golden-file protection for the Go enforcement paths, before enforcement callers switch to Go).

Prerequisite: the repository configuration reader in internal/config is already on main.

Size

XS. One pull request.

Verify plan

• AC1, AC2, AC3: Go table tests over the configuration states.
• AC4: a Bats case that runs the wrapper against a binary stub without the subcommand, and a case against a stub replacement that exits non-zero and one that returns unusable output, asserting the refusal.
• AC5: mise run generate-skills leaves no diff, mise run check-generated-skills passes, and a listing of the local deployment shows the regenerated wrappers.
• AC6: the CI matrix jobs for the Go packages.
• Definition of done: D1 each AC is verified at the merged head, with the commands and results cited in the pull request's Verification. D2 an independent review approves the exact merged head, and every finding has a recorded disposition. D3 required checks pass with no gate loosened. D4 the leak scans the repository specifies are clean, and every post made for this work passes the per-post leak review before it is posted. D5 every commit is signed. D6 the documentation matches the change or the Verification says why there is no impact. D7 every commit has an Assisted-by trailer and the pull request has the provenance:agent-assisted label. D8 the pull request stays within the size limits. D9 follow-ups are filed as issues and listed under Related. D10 the merge closes the issue through a closing reference, the board shows Done, and the final Status: comment names the merge commit.

Risks

agent.sh is owner-tier, and a wrong label could send owner reviews to a label nobody watches. Undo: revert the change, which restores the shell function.

Operator authority

Owner-only GitHub action: the owner's exact-head review. Owner-tier paths named: packages/agents/source/lib/agent.sh and its generated scripts/agent.sh copies are on the golden and owner path lists in .agents/agent-skills.conf, so the pull request needs the owner's exact-head review at merge.