Rung 5: verdict tags, chosen and carried

Opt-in per repository (RFC 0009 §verdict-tags)

repo.ci_tags (''	on	off): '' follows the fleet default the --ci-verdicts flag sets; on/off are the repository's own choice, a select under Integrations. The poller consults it per run. Tags already written stay on toggle-off (immutable artifacts, never shunned); toggle-on resumes from the next terminal run, no backfill.

Carry-forward (§premerge)

A premerge pair's verdict now reaches the DAG the only honest way it can: after the accept creates the real merge. The fold hook — the same place CI triggers — walks recently accepted landings; for a merge check-in with no verdict tag, it reconstructs the tested pair from the merge's two parents (order unrecorded, both spellings asked), judges it with PairVerdict — every required check green from the pair's runs and reports is ci-pass, a red required check is ci-fail, silence stays silent — and writes the tag once. Idempotent by the existing-verdict guard; gated by the same tags mode.

New seams: index.VerdictOf(checkin) and index.ParentsOf(checkin); api.Deps.PairVerdict(repo, pair, target).

Scope honesty

Auto-accept-when-green is the next rung; carry-forward currently covers the newest ten accepted landings per fold, which is every real fold's working set.