feat(intake): fund the intake lane from the automations role on run-claude-cli

.changes/pr-pipeline/feat-intake-on-run-claude-cli-4237677a.md

@@ -0,0 +1,11 @@
+---
+bump: minor
+---
+
+### Added
+
+- `funding`, a map from Claude lane id to its funding role (`reviews`, `automations` or
+  `issue-lane`), whose `<ROLE>_CLAUDE_API_KEY` and `<ROLE>_CLAUDE_CODE_OAUTH_TOKEN` secrets a lane
+  on ci-workflows' run-claude-cli action passes; intake is the first, and the other entries name
+  the role each lane takes when it moves ([README.md, Funding](https://github.com/melodic-software/claude-code-plugins/blob/main/docs/conventions/pr-pipeline/README.md#funding)).
+  `version` stays 2.

.github/workflows/intake-triage.yml

@@ -127,12 +127,14 @@ jobs:
     concurrency:
       group: intake-triage-${{ github.event.issue.number || inputs.issue-number || github.run_id }}
       cancel-in-progress: false
-    uses: melodic-software/ci-workflows/.github/workflows/intake-triage.yml@ff8cd36321423de961381e608e4a31563e74adb3 # v0.49.0
+    uses: melodic-software/ci-workflows/.github/workflows/intake-triage.yml@f129f4c142d00ec3feacbf2b9102d327088504bf # v0.51.0
     with:
       runner: ubuntu-24.04
+      role: automations
       claude-args: ${{ needs.born-triaged.outputs.claude-args }}
       issue-number: ${{ inputs.issue-number }}
       allowed-author-ids: ${{ needs.born-triaged.outputs.human-ids }}
       allowed-bot-sender-ids: ${{ needs.born-triaged.outputs.bot-ids }}
     secrets:
-      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+      CLAUDE_API_KEY: ${{ secrets.AUTOMATIONS_CLAUDE_API_KEY }}
+      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.AUTOMATIONS_CLAUDE_CODE_OAUTH_TOKEN }}

docs/conventions/pr-pipeline.yaml

@@ -349,6 +349,20 @@ models:
     # work-resolve-issue's read-only pass that describes a reused lane branch.
     summarize-reuse: summary
 
+# The funding role whose secrets pay for each Claude lane's runs (README.md,
+# Funding). A lane on ci-workflows' run-claude-cli action (today only intake)
+# passes its role with <ROLE>_CLAUDE_API_KEY and <ROLE>_CLAUDE_CODE_OAUTH_TOKEN,
+# role upper-snake; the others are the role each lane takes when it moves there.
+funding:
+  intake: automations
+  pr-unblock: automations
+  fix-ci: automations
+  pr-verify: automations
+  pr-refine: automations
+  claude-review: reviews
+  claude-security-review: reviews
+  work-resolve-issue: issue-lane
+
 loop:
   review-rounds: 3
   dependency-review-rounds: 2

docs/conventions/pr-pipeline/README.md

@@ -13,6 +13,7 @@
 - [Trust-root paths](#trust-root-paths)
 - [The lane sweep](#the-lane-sweep)
 - [Models](#models)
+- [Funding](#funding)
 - [Loop caps](#loop-caps)
 - [Limits](#limits)
 - [Planning lane work](#planning-lane-work)
@@ -954,6 +955,21 @@ every skill activity's; `review` (`opus`, 60 turns, no effort), the verifier's;
 30 turns), intake triage's and the [lane sweep](#the-lane-sweep)'s; and `summary` (`sonnet`, effort `medium`, 10 turns), the reuse
 summary pass's.
 
+## Funding
+
+`funding` maps each Claude lane or activity id to the funding role whose secrets pay for its runs:
+`reviews`, `automations` or `issue-lane`. A lane on ci-workflows' `run-claude-cli` action passes
+its role with the role's two secrets, `<ROLE>_CLAUDE_API_KEY` and `<ROLE>_CLAUDE_CODE_OAUTH_TOKEN`
+(role upper-snake, so `issue-lane` gives `ISSUE_LANE_`); the action tries the key first and the
+subscription token only after a credit stop. No workflow reads the map; each lane's workflow names
+its role and secrets, and the runner policy admits them. This repository's map: `intake`,
+`pr-unblock`, `fix-ci`, `pr-verify` and `pr-refine` take `automations`; `claude-review` and
+`claude-security-review` take `reviews`; `work-resolve-issue` takes `issue-lane`.
+
+Only `intake` runs on `run-claude-cli` today. Every other entry is the role its lane takes when it
+moves there: until then it runs claude-code-action with an OAuth token alone, and it never gets an
+API key, since claude-code-action runs are not paid from API credits.
+
 ## Loop caps
 
 One counter per PR, in the findings store, is shared by every lane. After `loop.review-rounds`

docs/conventions/pr-pipeline/pr-pipeline.schema.json

@@ -132,7 +132,13 @@
       }
     },
     "merge": { "$ref": "#/$defs/merge" },
-    "models": { "$ref": "#/$defs/models" }
+    "models": { "$ref": "#/$defs/models" },
+    "funding": {
+      "type": "object",
+      "propertyNames": { "$ref": "#/$defs/name" },
+      "additionalProperties": { "enum": ["reviews", "automations", "issue-lane"] },
+      "description": "Claude lane id -> the funding role whose secrets pay for its runs. The lane passes the role to run-claude-cli with <ROLE>_CLAUDE_API_KEY and <ROLE>_CLAUDE_CODE_OAUTH_TOKEN, role upper-snake (README.md, Funding)."
+    }
   },
   "$defs": {
     "name": {