GRM-50: fix: workflow timing, timeouts, status polling, and release classification

AGENTS.md

@@ -63,42 +63,31 @@ docs: update README
 
 ### 6. Review the PR (Mandatory — Before Adding ready-to-merge Label)
 
+**Review checklist:** Every PR is reviewed against
+[REVIEW_CHECKLIST.md](REVIEW_CHECKLIST.md) — 10 categories covering
+architecture, code quality, security, i18n, testing, performance,
+UX, documentation, workflow compliance, and maintainability.
+
 **Automated review (CI `pr-review` job):** Every PR triggers an automated
 review via `scripts/ci/pr_review.py`. This job posts a review with
-`COMMENT` (no issues) or `REQUEST_CHANGES` (issues found) based on:
+`COMMENT` (no issues) or `REQUEST_CHANGES` (issues found) based on
+the **[auto]** items in the checklist:
 
-- **Architecture compliance**: No subprocess calls in CLI (delegate to
-  executor.py), no hardcoded URLs (use config.py)
-- **Best practices**: No `print()` (use `click.echo`), no bare `except`,
-  no `TODO`/`FIXME` left in merged code, no functions > 50 lines
-- **Security**: No hardcoded secrets, no `shell=True`, no `eval`/`exec`
-- **Documentation**: Source changes must include doc updates
-- **Test coverage**: Source changes must include test updates
+- Architecture compliance (no subprocess in CLI, no hardcoded URLs)
+- Best practices (no `print()`, no bare `except`, no `TODO`/`FIXME`,
+  no functions > 50 lines)
+- Security (no hardcoded secrets, no `shell=True`, no `eval`/`exec`)
+- Documentation (source changes must include doc updates)
+- Test coverage (source changes must include test updates)
 
-The automated review posts inline comments on specific lines. The agent
-**must** address all `REQUEST_CHANGES` issues before proceeding.
+The automated review posts inline comments on specific lines and
+includes a link to the full checklist. The agent **must** address all
+`REQUEST_CHANGES` issues before proceeding.
 
-**Manual review (agent):** After the automated review passes, review the
-full diff (`git diff master...HEAD`) focusing on:
-
-- **Functional completeness**: Does the code do what it claims? Are all requirements met?
-- **Edge cases**: Are boundary conditions, empty inputs, error paths handled?
-- **Technical excellence**:
-  - Architecture compliance and evolution
-  - Single Responsibility Principle (SRP)
-  - Deduplication (no copy-paste, single source of truth)
-  - Code smells detection and removal
-  - Best industry practices
-  - Industry-grade code quality
-  - Reusability
-  - Clean code
-  - Readability
-  - Maintainability
-  - Extensibility
-- **Performance**: No unnecessary allocations, O(n) vs O(n²), efficient data structures
-- **Security**: No secrets in logs/process list, input validation, no injection vectors
-- **User experience**: Clear error messages, intuitive CLI flags, helpful output
-- **Documentation**: Completeness and relevance of docs, CHANGELOG entries, AGENTS.md updates
+**Manual review (agent):** After the automated review passes, the agent
+must go through **every category** in `REVIEW_CHECKLIST.md` and verify
+the **[manual]** items by reviewing the full diff
+(`git diff master...HEAD`).
 
 Post review comments using `scripts/ci/review_pr.py`:
 ```bash
@@ -112,15 +101,19 @@ REPO_TOKEN=<token> python3 scripts/ci/review_pr.py <pr_number> <owner/repo> \
 Fix each comment one by one, commit, and push. Re-review until satisfied.
 
 ### 8. Approve and Merge
-Once all comments are addressed, post a **substantive** approval review
-(body must be > 20 characters — trivial "LGTM" approvals are rejected
-by the auto-merge gate):
+Once all checklist items are verified and comments are addressed, post
+an approval review with `--checklist-confirmed`:
 ```bash
 REPO_TOKEN=<token> python3 scripts/ci/review_pr.py <pr_number> <owner/repo> \
-  --event APPROVE \
-  --body "All review comments addressed. Architecture compliance verified, tests pass, docs updated."
+  --event APPROVE --checklist-confirmed \
+  --body "All 10 REVIEW_CHECKLIST.md categories verified. Architecture: <summary>. Security: <summary>. Tests: <summary>. Docs: <summary>."
 ```
 
+The `--checklist-confirmed` flag is **required** for APPROVE events —
+it attests that the reviewer has gone through every checklist category.
+The review body must also be substantive (> 20 characters) — trivial
+"LGTM" approvals are rejected by the auto-merge gate.
+
 Then add the `ready-to-merge` label. The auto-merge workflow will:
 1. **Validate** PR title format (`GRM-N: <vikunja task title>`) and match against Vikunja task title
 2. **Check** that at least one substantive APPROVE review exists (body > 20 chars or has inline comments)