Add a repo-onboarding skill (labels + allowlist + checks)

[rubambiza]

Problem

Onboarding a repo into the automation scan set today means several manual, easy-to-forget steps done per-repo. Repos end up half-configured — e.g. 5 of the 8 core repos were in the allowlist but missing the ready-for-ai-review / ready-for-human-review labels, so the PR-review flip could never work there.

Proposal

A single hybrid skill wrapping a deterministic script, usable three ways:

1. Standalone: onboard-repo.sh <org>/<repo>...
2. From OpenClaw via natural-language invocation (calls the script under the hood).
3. As a Claude Code plugin skill (like github-pr-review).

Actions per repo (idempotent)

1. Archived check (read-only) — abort for that repo if archived.
2. Dependabot coverage (read-only, detect-and-report only).
3. Create the two review labels — maintainer identity; canonical colors/descriptions.
4. Add <org>/<repo> to config/core-repos.txt — commit DCO-signed by the maintainer, PR opened from the clawgenti fork; skip if already present.
5. Per-repo summary report.

Out of scope

Pushing dependabot.yml, branch protection, fixing stale workflow refs, or any admin-gated setting. Detect-and-report is the ceiling beyond config + labels.

Notes

• Identity split: labels + config commit use the maintainer identity (DCO); PR opened from the clawgenti fork.
• Dependency: the clawgenti/automation fork does not exist yet — the config-PR step must create it first.
• Impl gotcha: gh label list defaults to a 30-label cap; use --limit when checking existing labels.