ops(required-workflows): enroll TEPP in OpenCode/Noema review and scheduler dispatch #795

Observed blocker

ContextualWisdomLab/TEPP is a new public organization repository covered by the documented ~ALL required-workflow policy, but its protected PR stack is not receiving the independent review identities needed to merge.

Current evidence:

• TEPP Add Palette journal for profile repo #1 exact head 32e5fd22d66830a27172db3d42a1229dcc757587 has successful repository-local Documentation Quality (31002956033), SAST Semgrep (31002955907), Security Scan (31002955843), successful CodeRabbit commit status, and zero unresolved current threads.
• TEPP Add Superset workspace config #3 exact head 61c9851042f1ce1de39918b456669a1dc47a0282 has successful Rust Foundation CI (31008979592) and Documentation Quality (31008980043) with zero open threads.
• TEPP Add OpenCode review merge automation #4 exact head b12377ac83dbecb41927b615286e683629d175f4 has successful Rust Foundation CI (31063124336), Documentation Quality (31063124391), successful CodeRabbit commit status, 41 tests with zero skips, and 100% production line and branch coverage.
• Add Palette journal for profile repo #1 has been toggled Draft → Ready and exact-head review requests have been posted more than once. Add OpenCode review merge automation #4 was also marked Ready with an exact-head request.
• No opencode-agent or cwl-noema-review[bot] review submission is present on these current heads. The only submitted reviews on Add Palette journal for profile repo #1 are historical GitHub Advanced Security comments.
• Direct mention routing is not yet an available production fallback because central PR feat(automation): route trusted review-agent mentions #787 remains unmerged.

Required investigation

1. Verify the active organization ruleset targets TEPP's default branch and still references the current central required-workflow paths.
2. Verify the OpenCode GitHub App and cwl-noema-review App are installed for TEPP with the intended repository-scoped permissions.
3. Verify OPENCODE_REPOSITORY_DISPATCH_TARGETS contains the exact canonical repository name when targeted dispatch is used.
4. Verify the organization sweep credential can read and mutate TEPP rather than classifying it as an unavailable repository.
5. Trigger evidence-only current-head OpenCode and Noema review for TEPP Add Palette journal for profile repo #1 without branch update, auto-merge, direct merge, release, or protection bypass.
6. Record the exact workflow run IDs, reviewer identities, head SHA binding, and concrete failure reason when any enrollment or credential prerequisite is absent.

Security constraints

• Do not rename, duplicate, or repurpose existing reviewer credentials.
• Do not use COPILOT_GITHUB_TOKEN.
• Do not synthesize or self-submit approval.
• Do not weaken the required independent non-author approval rule.
• Keep model execution, reviewer identity, and repository mutation within the existing central trust boundaries.
• Use NVIDIA_NIM_API_KEY only where the established review workflow already permits it.

Acceptance

TEPP #1 receives exact-current-head OpenCode and independent Noema verdicts through the protected central workflow, and the scheduler publishes a concrete merge decision without administrative bypass. The same enrollment must work for stacked #3 and #4 after their base order is satisfied.