bootstrap wizard: REVIEWER_ASSIGNMENT_TOKEN never provisioned (stale 1Password title path)

[nathanpayne-claude]

What broke

During the github-infra stage of scripts/bootstrap-new-repo.sh, the REVIEWER_ASSIGNMENT_TOKEN repo secret is silently not set, because the 1Password reference it probes is a title-based path that no longer resolves. Every newly bootstrapped repo therefore ships without REVIEWER_ASSIGNMENT_TOKEN, and its reviewer-assignment / agent-review workflows fail on the first PR until the secret is added by hand.

Discovered while bootstrapping gaycruisebingo (this session).

Steps to reproduce

1. op read "op://Private/REVIEWER_ASSIGNMENT_PAT/token" → returns an [ERROR] (no item resolves by that title).
2. Run a bootstrap with 1Password unlocked and BOOTSTRAP_AUTO_PROMPT=skip (so the interactive paste fallback is skipped), e.g. scripts/bootstrap-new-repo.sh <name> --visibility public --firebase none --project new --codex-app n.
3. gh secret list --repo <owner>/<newrepo> → no REVIEWER_ASSIGNMENT_TOKEN.

Expected behavior

With the 1Password session already unlocked, the secret is provisioned headlessly during bootstrap, matching sibling repos (e.g. swipewatch has REVIEWER_ASSIGNMENT_TOKEN set).

Actual behavior

The provisioning step (scripts/bootstrap/github-infra.sh:283-364) probes the default reference and, on failure with prompts skipped, warns and continues without setting the secret:

[bootstrap] REVIEWER_ASSIGNMENT_TOKEN: probing 1Password at op://Private/REVIEWER_ASSIGNMENT_PAT/token
[bootstrap] WARN: REVIEWER_ASSIGNMENT_TOKEN: no PAT available + prompts skipped; not setting secret

Root cause: scripts/bootstrap/github-infra.sh:73 defaults the op reference to a title path:

BOOTSTRAP_REVIEWER_PAT_OP_REF="${BOOTSTRAP_REVIEWER_PAT_OP_REF:-op://Private/REVIEWER_ASSIGNMENT_PAT/token}"

Looking the item up by title (REVIEWER_ASSIGNMENT_PAT) contradicts the repo's own convention to resolve PATs by item UUID (root CLAUDE.md § 1Password Reviewer PAT Lookup: "Always look a PAT up by 1Password item ID, never by item title"). The token's intended value is the nathanpayne-claude reviewer PAT — confirmed by .github/workflows/daily-feedback-rollup.yml:12 ("the nathanpayne-claude PAT") — whose item UUID is pvbq24vl2h6gl7yjclxy2hbote (op://Private/pvbq24vl2h6gl7yjclxy2hbote/token), also exported in-session as $OP_PREFLIGHT_REVIEWER_PAT.

Acceptance criteria

• Failure mode confirmed (op read on the title path errors; secret absent after a real run).
• The default BOOTSTRAP_REVIEWER_PAT_OP_REF resolves the reviewer PAT reliably — UUID path op://Private/pvbq24vl2h6gl7yjclxy2hbote/token, or reuse of the already-cached $OP_PREFLIGHT_REVIEWER_PAT.
• Provisioning failure is made louder / non-silent (today it warns and continues, so a broken reference ships unnoticed).

Notes / risks

• Workaround used this session: set it as the author — gh secret set REVIEWER_ASSIGNMENT_TOKEN --repo <owner>/<newrepo> --body "$OP_PREFLIGHT_REVIEWER_PAT".
• Because the failure is warn-only, it is easy to miss: the repo looks fully bootstrapped, but its first PR's reviewer-assignment / agent-review workflows will fail until the secret exists.
• Same title-vs-UUID footgun the machine notes already warn about; worth auditing any other op://…/<title>/… references in the bootstrap scripts at the same time.