autopilot(qa): bounce back to the dev instead of halting; stop after 3 bounces

Per maintainer: @qa must never change code — it only accepts a PR or sends it back to the dev with
precise instructions. Replaces the halt-on-any-problem behavior with a bounce loop:

- QA prompt: emit MERGE_PR (approve), or `BOUNCE: @<dev>` after spelling out exactly what to change.
  HALT_AUTOPILOT is now only for problems a dev can't fix (needs a human decision).
- publish.sh: on BOUNCE, re-trigger the named dev (via AGENT_TOKEN) with "autopilot fix attempt N/3".
  Count prior attempts from the PR thread; at 3 it stops (removes the label) and hands to @ffaerber.
- publish.sh: after a dev pushes a fix (resume), auto-re-trigger @qa to re-verify — closing the loop
  (dev fix -> qa re-check -> merge or bounce again).
- Updated the initial @qa trigger wording (bounce, not halt).

Verified: BOUNCE target parsing and the 3-strike counter (attempts 1/3,2/3,3/3 then HALT).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/scripts/run-agent.sh

@@ -71,17 +71,20 @@ if [ "$MODE" = "comment" ]; then
    a human does that."
     if [ "$AUTOPILOT" = "true" ]; then
       ACTION="$ACTION
-   AUTOPILOT MODE IS ACTIVE (this issue/PR carries the 'autopilot' label). This grants you a
-   NARROW, one-time merge authority for THIS PR only:
-   - If, after verifying, the PR is correct and any CI checks are green, end your reply with EXACTLY
-     one line: 'MERGE_PR'. The automation will then merge the PR and close the linked issue for you.
-     Do NOT merge via any other means; only the MERGE_PR marker triggers the merge.
-   - If you find ANY bug, doubt, or the change is not clearly correct, do NOT merge. Instead describe
-     the problem clearly and end your reply with EXACTLY one line: 'HALT_AUTOPILOT'. The automation
-     removes the 'autopilot' label (returning this issue to normal human control) and leaves
-     it for @ffaerber to decide next steps. Never auto-bounce back to a dev.
-   Emit AT MOST one of MERGE_PR or HALT_AUTOPILOT, and only after you have actually verified. When in
-   doubt, prefer HALT_AUTOPILOT."
+   AUTOPILOT MODE IS ACTIVE (this issue/PR carries the 'autopilot' label). You are the quality gate.
+   You do NOT edit code or fix anything yourself — you either accept the PR or send it back to the dev
+   with precise instructions. After actually verifying, end your reply with EXACTLY one of:
+   - 'MERGE_PR' — the change is correct and any CI is green. The automation merges the PR and closes
+     the linked issue. Do NOT merge by any other means; only this marker triggers the merge.
+   - 'BOUNCE: @<dev>' — something needs changing. FIRST spell out, specifically and actionably, exactly
+     what the dev must change (name the file, label, value, hostname, etc.), THEN end with the BOUNCE
+     line naming who should fix it (@junior / @senior / @lead — usually whoever built it; @senior or
+     @lead for something harder). The automation sends the PR back to that dev and then re-verifies
+     with you. After 3 bounces it stops automatically and hands to @ffaerber — so make each round
+     count and list ALL problems at once, not one at a time.
+   Use BOUNCE for anything a dev can fix. Only use 'HALT_AUTOPILOT' when the problem is NOT fixable by
+   a dev — the request itself is ambiguous or needs a human decision — to hand back to @ffaerber.
+   Emit AT MOST one of MERGE_PR / BOUNCE / HALT_AUTOPILOT, and only after you have actually verified."
     fi
   fi
 else