Add a human-merge label that keeps autopilot from merging

autopilot skips both human checkpoints: approval before the build and the
merge. Scheduled update issues in homelab want the hands-off build but a human
merge, since merging there deploys. With human-merge also on the issue, @pm is
told to hand back at phase 3 and publish.sh refuses MERGE_PR.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitea/workflows/scripts/publish.sh

@@ -4,7 +4,7 @@
 # Required env (provided by the workflow step):
 #   GT TOKEN_PM TOKEN_SENIOR TOKEN_JUNIOR TOKEN_LEAD TOKEN_QA
 #   NAME MODE NUM TITLE BRANCH NEW GITHUB_SERVER_URL GITHUB_REPOSITORY
-#   IS_PR AUTOPILOT ISSNUM  (autopilot: @qa label-gated merge/halt + auto-trigger @qa on a fresh PR)
+#   IS_PR AUTOPILOT AUTOMERGE ISSNUM  (autopilot: @qa label-gated merge/halt + auto-trigger @qa on a fresh PR)
 set +e   # publish is best-effort: a grep-no-match / curl non-zero must NOT kill the step
 # Post/PR as the agent's OWN Gitea user when its token is configured; else the built-in bot.
 case "$NAME" in
@@ -222,9 +222,10 @@ if [ "$MODE" != "pr" ]; then
   fi
 
   # --- @pm autopilot merge: @pm is the ONLY agent that merges, and ONLY under the autopilot label ---
+  # (and never when `human-merge` is also set — AUTOMERGE is false then).
   # (@qa never merges — it approves and hands back here.) Merge with the PAT (TTOK), not the built-in
   # token, so the push to main fires the deploy. TOKEN_PM must carry write:repository.
-  if [ "$NAME" = "pm" ] && [ "$AUTOPILOT" = "true" ] && grep -qiE '^[[:space:]]*MERGE_PR[[:space:]]*$' /tmp/agent_out.md; then
+  if [ "$NAME" = "pm" ] && [ "$AUTOMERGE" = "true" ] && grep -qiE '^[[:space:]]*MERGE_PR[[:space:]]*$' /tmp/agent_out.md; then
     PRS=$(resolve_prs); PRN=${PRS##* }; CNT=$(echo "$PRS" | wc -w)
     if [ -z "$PRN" ]; then
       echo "MERGE_PR but no open PR found for issue #$ISSN"