Launch managed agents from labeled Forms Workflows issues

[matteius]

Summary

• Launch a Kimi K3 DigitalOcean Harness Runtime session when a maintainer labels a public issue agent-candidate.
• Clone the base repository in the session and push agent changes to a dedicated fork with Actions disabled; the launcher exits after submitting the prompt.
• Use the shared signed push webhook to open a regular PR against main, with manual merge and the repository's existing PR CI.
• Add an issue template and operator notes.

Infrastructure configured

• Scoped write deploy key on matteius/django-forms-workflows; the base repository holds only its encoded private key as an Actions secret.
• Required DigitalOcean and model Actions secrets, plus HARNESS_AUTOMATION_ENABLED=true.
• Signed fork push webhook to the shared PR broker; daily session cleanup in storefront.
• Base main protection requires PRs and prevents force pushes; zero approving reviews are required.

Validation

• Manifest validated with doctl harness-runtime validate.
• Launcher shell passed bash -n and YAML parsed.
• Fork deploy key authenticated with git ls-remote.
• Shared broker tests passed (5/5), including the Forms Workflows routing case.
• No live issue was labeled, so no billable agent session was started for this setup.