Publish CI label gate avoids stale CI and auto-approve races

Publish must be triggered only by a fresh ci-ready label event, never directly by accepted. After accepted is present, waiting-for-ci clears stale ci-ready, adds ci-pending, and starts the poller; the poller replaces ci-pending with ci-ready only after CI passes. Publishing requires an open issue with accepted and ci-ready, and neither ci-pending nor ci-failed. Do not use a separate issue-opened ci-pending workflow: it races auto-approval. This event-driven flow prevents parallel label workflows from publishing stale or unverified state.