Run the engine tick as a privileged GitHub Actions workflow

[ronimoe]

Context

The tick is a Python library today; production runs it under the bot App token on merge_group + the gh-readonly-queue/* ref prefix.

Scope

• Workflow YAML with a concurrency group; checkout + run LaneEngine/BatchEngine; emit the required conductor-landed status check.
• Wire the dispatcher to assign lanes on PR events.

Acceptance

Labeling a PR triggers the tick in Actions and it lands via force-with-lease, with the required check turning green.

Seam

new .github/workflows/, lane_engine.py, dispatcher.py.

[ronimoe]

Scaffolded in ddd23b3.

.github/workflows/conductor-tick.yml runs the privileged tick under the bot App token (concurrency-grouped; event-driven on check_run: completed + a cron backstop + manual dispatch). tick_runner.py routes ready PRs into lanes, reads each PR's conductor-spec verdict, and lands via LaneEngine/BatchEngine; the reconciler completes any crashed land. conductor-ci.yml produces the verdict. Both workflows are injection-safe (no untrusted input in run: lines — SHA via env:, report via jq --rawfile).

Remaining for full close: validate on a sandbox repo with the App installed (depends on #3); add hostile-branch-name validation in tick_runner.