infra[notask]: retire the verify label in favour of verified

[Proletter]

Summary

The verified label already gates every secret-bearing workflow via label-gate (108 workflows since QVAC-18612). The legacy verify label was still in use on five paths for non-secret heavy CI and a per-package merge assertion, forcing reviewers to apply two labels for the same trust ceremony.

This PR collapses everything onto verified. No workflow reads verify after this lands.

What changed

Layer	Change
Merge gate	public-pr.yml now requires verified for the per-package validate-pr job (called from 13 on-pr-*.yml).
Heavy NPM CI	public-reusable-npm.yml integration-tests step gates on verified.
inference-addon-cpp	Bespoke verify-fresh-apply logic in pr-test-inference-addon-cpp.yml + -js.yml replaced with verified-presence + fork-synchronize deny. The -verify.yml strip workflow deleted — it would conflict with label-gate's verified strip policy.
Registry server	pr-models-validation-registry-server.yml comment refreshed; its authorize-pr invocation picks up the new default.
Composite action	.github/actions/authorize-pr/action.yml default flipped verify → verified. Affects 17 consumers that all already pair authorize-pr with a label-gate job requiring verified, so the change removes the double-label awkwardness for fork PRs without altering the trust model.
Docs	docs/ci/LABELS.md collapses the deprecated row + expands the verified section. .cursor/skills/devops-why-my-pr-not/SKILL.md C6 drops the verify-deprecation caveat.
Cosmetic	6 on-pr-*.yml workflow_dispatch input descriptions and 2 integration-mobile-test-*.yml comments. run_verify variable kept to avoid breaking dispatch scripts.

Behaviour changes worth flagging

1. inference-addon-cpp re-runs on push — heavy native + JS matrices now re-trigger on every trusted same-repo push to a verified PR (previously required a remove+re-add ceremony per push). Bounded by the existing paths: filter so only PRs touching packages/inference-addon-cpp/** pay the cost. Fork PRs still need re-labelling on push, mirroring label-gate's strip-on-non-trusted-sync policy.
2. verify GitHub label not deleted — this PR retires every CI consumer, but the label itself stays in the repo so in-flight PRs (feat[api]: add @qvac/ocr-ggml package (EasyOCR + Doctr pipelines, GGML/GGUF) #2050 etc.) aren't surprised. After merge: gh label delete verify --repo tetherto/qvac.

Validation

• 58/58 label-gate unit tests pass.
• actionlint issue count unchanged across the five edited critical workflows (30 pre-existing shellcheck warnings in the PowerShell/CMake matrix — none in any of my edits).
• yaml.safe_load round-trips every modified workflow.
• Grep for residual verify label references in .github/ returns only the human-facing run_verify workflow_dispatch input names (kept intentionally) and the unrelated qvac verify CLI subcommand bats test.

Test plan

This PR itself is the integration test — applying verified to it should exercise every gate that this PR touches:

• Without verified: any public-pr.yml-derived validate-pr jobs report the new error string; all label-gate-gated jobs skip as expected.
• With verified applied by a trusted reviewer: secret-bearing jobs run; validate-pr passes; authorize-pr outputs allowed=true.
• No workflow in this PR references the deleted pr-test-inference-addon-cpp-verify.yml.
• Approval bot continues to count verified as tier 1 (unchanged from PR QVAC-18613 infra: recognise verified label as explicit tier 1 in approval bot #2006).

Follow-up

After merge:

• gh label delete verify --repo tetherto/qvac (only once in-flight PRs have been resolved).
• Decide whether to also remove the authorize-pr composite action entirely now that label-gate covers its single remaining use case, or keep it as a thin shim. Not blocking this PR.

Made with Cursor

[github-actions]

Tier-based Approval Status

**PR Tier:** TIER1

**Current Status:** ✅ APPROVED

**Requirements:**
- 1 Team Member approval ✅ (1/1)
- 1 Team Lead OR Management approval ✅ (1/1)



---
*This comment is automatically updated when reviews change.*

[kinsta]

Preview deployments for qvac-docs-staging ⚡️

Status	Branch preview	Commit preview
✅ Ready	Visit preview	Visit preview

Commit: e95247e420ee900212553c41b124d15451644e9c

Deployment ID: 3ff33a4b-29c5-4203-ad12-881b36587175

Static site name: qvac-docs-staging-fazwv