Filter fullsend/onboard branch from shim workflow dispatch

[fullsend-ai-retro]

What happened

PR #1285 is an automated onboarding PR on the fullsend/onboard branch, created and merged by platform bots within ~2.5 minutes. The closed event triggered fullsend.yaml run 33935725592, which dispatched retro run 33935736390. No review, code, or fix agents ran — only the retro agent, which has nothing meaningful to analyze on a platform-managed onboarding PR with no linked issue, no agent-driven code, and no human interaction. The dispatch investigation found 50+ PRs following this same pattern in halfsend-10/test-repo alone, each triggering a wasted retro dispatch.

What could go better

The shim workflow template at internal/scaffold/fullsend-repo/templates/shim-workflow-call.yaml already filters fullsend/scaffold-install from pull_request_target and pull_request_review events to prevent unnecessary dispatches. However, the fullsend/onboard branch is not similarly filtered, causing retro agents to be dispatched on every onboarding PR close across all enrolled repos. This is wasted compute — the retro agent consumes tokens analyzing a null workflow (no code/review/fix agents ran, no issue linkage, no human participation). Confidence is high: the mechanism is clearly visible in the shim's if condition and confirmed by the dispatch logs showing stage=retro routing for the closed event.

Proposed change

Extend the branch exclusion filter in the shim workflow template (internal/scaffold/fullsend-repo/templates/shim-workflow-call.yaml) to also cover fullsend/onboard. The current filter is:

github.event.pull_request.head.ref != 'fullsend/scaffold-install'

Consider broadening to a prefix match that covers all platform-managed branches:

!startsWith(github.event.pull_request.head.ref, 'fullsend/')

This would future-proof against additional platform-managed branch names (e.g., if new onboarding or reconciliation branches are introduced). If other fullsend/-prefixed branches exist that need agent processing, the narrower fix of adding fullsend/onboard explicitly alongside fullsend/scaffold-install is safer. The reconcile-repos deployment process would propagate this change to all enrolled repos on the next shim sync.

Validation criteria

After the change is deployed and shims are reconciled: (1) new onboarding PRs on fullsend/onboard branches should not trigger any fullsend.yaml workflow runs on pull_request_target events, (2) retro agent runs in .fullsend dispatch repos should no longer appear for onboarding PR closures, (3) non-platform PRs (e.g., agent/* branches from the code agent) should continue to dispatch review and retro agents normally. Verify across at least 3 enrolled repos over a 1-week window.

---

Generated by retro agent from halfsend-10/test-repo#1285