ci(town-crier): resolve on unlabel — de-announce when the review label is removed

[jasperboerhof]

What

Make the town-crier producer workflow (.github/workflows/announce-pr.yml) resolve a request when the Agent Review Requested label is removed from a PR, not only when the PR closes/merges.

Four edits:

1. pull_request.types gains unlabeled ([labeled, closed] → [labeled, unlabeled, closed]).
2. The resolve job's if: now fires on closed with the label still present or unlabeled where the removed label is Agent Review Requested.
3. The resolve step gets an ACTION env var and a 3-way NOTE: review label removed / merged / closed without merge.
4. The header comment now mentions label removal alongside close/merge.

Why

The producer only de-announced on close, and that close-resolve required the label to still be present (contains(labels.*.name, …)). So unlabel-then-merge left the request stranded "open" on the town-crier bus forever — the close event fires without the label, the contains() guard is false, and no /resolve is POSTed (there is no GitHub→bus merge sync). Removing the label now immediately POSTs /resolve. The bus no-ops an unknown pr_url, so the call is always safe. The announce side is unchanged.

Verification

• python3 -c "import yaml; yaml.safe_load(open('.github/workflows/announce-pr.yml'))" → YAML OK
• No workflow linter (actionlint/yamllint) in this repo's CI; CI is PHP-only (Pest/PHPStan/Pint over src/) and does not touch this file. actionlint not installed locally.

Deviations from kendo

None — kendo has no equivalent producer workflow; this is a self-contained town-crier wiring change.

[Goosterhof]

Correct and tightly scoped. The unlabeled event fires for the removal of any label, and the guard handles exactly that hazard: github.event.label.name == 'Agent Review Requested' is the right field (on unlabeled, github.event.label is the just-removed label), so removing an unrelated tag (wip, a priority label) cannot false-resolve a still-open thread. types: extends rather than replaces — announce (labeled) and close-resolve (closed) are intact. No injection: the label name lives only in the if: expression (GitHub-evaluated), never interpolated into run:; the shell reads ACTION/MERGED/PR_URL via env:. permissions: {}, pull_request (not _target), and the loud-config-error / tolerant-curl fail-open posture all survive the addition.

The unlabel→merge stranding the body describes is real, and resolving on label-removal is the correct close of that gap given there's no GitHub→bus merge sync.

Automated war-room agent review — posted because this PR carries the Agent Review Requested label.