fix(kanban): a failed sibling-merge label write must not abort the sweep

[LukasWodka]

Closes tracebloc/backend#1598, under epic backend#1680.

The bug

The sibling-merge label writes ran bare under set -euo pipefail. The comment called this "hard-fails per the PROJECTS_KANBAN_TOKEN write rule" — but a hard fail here doesn't fail one item, it aborts the whole step mid-loop:

• every item after the failure goes unprocessed
• added.tsv is left truncated at the failure point
• everything downstream still reads it as the complete record

A 403 on this write is also the likeliest failure in the step: PROJECTS_KANBAN_TOKEN is one user PAT shared by CI, the conformance gate, the weekly cron and any local script, all on one 5,000/hr budget.

The fix

Record the failure in add_fail instead. The existing end-of-step check already turns a non-zero add_fail into a red run, so the rule is kept — the run still fails. The sweep just finishes first, and the record stays complete.

Fail closed, finish the work. The label-create call is also made non-fatal with an explicit notice, since a missing label is reported by the write that follows it.

Reproduced, both ways

A gh stub that 403s the label POST, three items in the loop:

	exit	added.tsv rows
before	1	0 — aborted on item 1, record empty
after	1	3 — all swept, ::error::3 item(s) failed emitted

Both fail closed. Only the completeness differs — which is the whole bug.

Ordering is unchanged: the label is still written after the status, so a label failure can never cost a card its column (.github#157's lesson).

---

Note

Low Risk
Workflow-only error handling in the kanban reconcile job; no app runtime, auth, or data-path changes.

Overview
Membership sweep in kanban-reconcile.yml no longer lets a failed sibling-merge label API call exit the loop under set -euo pipefail. Those writes are counted in add_fail instead, so the run still fails closed at the end of the step but finishes every missing item and keeps added.tsv complete.

Label create and apply are wrapped so failures emit [WARN] with captured gh stderr (and a status_note when Status was set). The final ::error:: message now explicitly includes sibling-merge label write failures alongside add/Status failures.

^{Reviewed by Cursor Bugbot for commit 5a9995f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 5a9995f. Configure here.}

[shujaatTracebloc]

Approve (backend#1598). The sibling-merge label writes ran bare under set -euo pipefail, so a 403 (the single most likely failure — one shared PROJECTS_KANBAN_TOKEN PAT on a 5000/hr budget) aborted the WHOLE sweep mid-loop, leaving every later item unprocessed and added.tsv truncated but still read as complete. Now the failure is counted into add_fail (run still goes red at end — rule kept) so the sweep finishes and the record stays whole. Keeps the captured stderr so an operator can tell a rate-limit from a missing scope. Label write stays AFTER the status write (#157 ordering lesson preserved). CI green, Bugbot resolved.