ci(2396): give .github its own customer-priority-bump caller, ahead of the flip (backend#2396)

[LukasWodka]

Wires this repo to the customer-priority-bump.yml reusable — the last of the three
that were never wired (release-train#117 and rfcs#47 are the others).

Why now

.github#313 (backend#2348) added a second job to that reusable, bug-to-ready, which
moves a work-type:bug issue's card from Backlog to Ready. Without a caller, a bug
filed here still lands in Backlog — the refinement queue nobody pulls from — and
org-standards.md currently carries a sentence naming these three repos as the
exception.

The exemption's stated blocker has expired. The anchor
customer_priority_bump_caller_missing cites backend#1408 P3 — "three dead inputs and
hard-codes the priority label". Measured 2026-08-23:

claim	today
sequenced behind #1408 P3	#1408 is CLOSED COMPLETED
three dead inputs	all four are consumed — trigger-label ×1, bug-label ×2, project-number ×1, org ×1
hard-codes priority	true, and deliberate: RFC-BACKEND-0008 D5 made priority a binary label, not a board field. Documented at the call site.

Named -caller.yml, and that is not cosmetic

customer-priority-bump.yml in this repo is the reusable. A caller under the same
name would overwrite the thing it calls. This repo pairs <name>.yml with
<name>-caller.yml throughout — stale-backlog, set-pr-status, fr-gate,
advance-deploy-env, code-quality, fr-pass-comment, kanban-closure.

This ships ahead of the flip, and there is a red window

The repo-inventory.yml row stays exempt until a separate, later PR flips it. That
split is forced, not preferred — the same deadlock #307 documented for the stale sweep:
the audit reads caller presence from the audited branch over the API, so this
repo's caller does not exist on develop until this merges, and bundling the flip would
fail MISSING required caller on its own PR forever because gate is required.

Known transient: exempt plus a caller on the audited branch is itself a finding
(caller-drift.py:2260), so this repo's audit goes red between this merge and the
flip — and while it is red, every other GUARDED-file PR is blocked. Suggested order:

1. release-train#117 and rfcs#47 (no effect on this repo's audit)
2. .github#306 — already open and waiting on a green audit; land it first
3. this PR (opens the red window)
4. the flip PR, immediately after (closes it, and deletes the canon exception clause)

No inputs, no permissions: block

Matching all 16 working callers and the callee, which declares neither. Every input
is defaulted, and a grant narrower than the callee needs fails the run at startup with
no jobs.

Verification

Not "this merged". The first work-type:bug issue filed here afterwards landing in
Ready untouched. The caller pins @main, so this also depends on bug-to-ready having
been promoted to .github's main.

Part of tracebloc/backend#2396 — not Closes, since the ticket also covers the two
sibling callers and the inventory flip.

---

Note

Medium Risk
Inherits secrets and will auto-label issues and move kanban cards. Also opens a known audit-red window that blocks other GUARDED-file PRs until the follow-up inventory flip.

Overview
Adds a thin customer-priority-bump-caller.yml so this repo finally invokes the existing reusable on issues: labeled. Bugs labeled work-type:bug can move from Backlog to Ready, and from:customer still gets the binary priority label.

Named -caller.yml because customer-priority-bump.yml is the reusable in this repo. No inputs or permissions: block; defaults and secrets: inherit match the other working callers.

Does not flip inventory from exempt to required. That must land in a follow-up immediately after, because merging this alone makes exempt + caller a known audit finding and will block other GUARDED-file PRs until the flip.

^{Reviewed by Cursor Bugbot for commit e0e3179. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit e0e3179. Configure here.}

[saqlainsyed007]

Reviewed — approving. A correct thin caller for .github's own customer-priority-bump: named -caller.yml because customer-priority-bump.yml in this repo is the reusable itself (matching the repo's <name>/<name>-caller pairing throughout), secrets: inherit, no inputs (all four defaulted) and no permissions: block — matching the callee and the 16 working callers. Shipping ahead of the exempt→required flip is forced, not preferred (bundling the flip would fail MISSING required caller on its own PR since the audit reads the caller off develop, which won't have it until merge — the #307 deadlock). The transient red audit between this merge and the follow-up flip is documented and is the cost of the land-caller-first rule, not a defect in this file. Green: checks pass, no open threads.