The [Monitor Oxc
job](https://github.com/oxc-project/oxc/actions/runs/30413998931/job/90456346227?pr=25041)
fails for fork PRs because `pull_request` workflows do not receive
repository secrets, leaving the GitHub App client ID empty.
Keep the `run-monitor-oxc` label trigger for same-repository PRs. Fork
label events are skipped before secrets are used; a trusted maintainer
can trigger them with `/monitor-oxc run` instead. The comment path
verifies triage permission, rejects PRs pushed after the command, and
dispatches the exact head SHA. This follows [Vite's ecosystem CI
workflow](https://github.com/vitejs/vite/blob/main/.github/workflows/ecosystem-ci-trigger.yml).
Verified with `just ready`.
AI assistance was used to investigate the failure and prepare this
change.
## Summary
Add `.github/workflows/monitor-oxc.yml`. When a maintainer adds the `run-monitor-oxc` label to a PR, the workflow posts a placeholder comment, mints a GitHub App token, and dispatches `ci.yml` on `oxc-project/monitor-oxc` with `issue-number`, `comment-id`, and `ref: refs/pull/N/head`. monitor-oxc's existing `comment` job then edits the placeholder in place with the per-suite result table.
Consolidates the duplicated dispatch logic in `prepare_release_crates.yml`: the standalone `ecosystem-ci` job (and the now-unused `outputs:` on `prepare`) is replaced by a single `labels: run-monitor-oxc` input on `peter-evans/create-pull-request`. Because the action creates the PR with the App token, attaching the label fires `pull_request: labeled` on `oxc-project/oxc` and re-enters the new workflow.
## Operational notes
- The `run-monitor-oxc` label needs to be created once in repo settings — proposed color `#55e1cc` (same as `run-bench`) with description "Add to a PR to dispatch oxc-project/monitor-oxc CI against it". The workflow's `if:` guard ignores the event when the label name doesn't match, so missing the label only means the workflow does nothing — no errors.
- The GitHub App is already authorized to dispatch into `monitor-oxc` (same `repositories: monitor-oxc` token mint used by the old `ecosystem-ci` job in `prepare_release_crates.yml`).
- One-shot: removing and re-adding the label dispatches a new run. Pushing new commits while the label is still attached does **not** auto-retrigger.
## Behavior delta for release-prep flow
- *Before:* dispatch passed no `ref`, so monitor-oxc defaulted to `main` and tested `oxc-project/oxc@main` as of dispatch time (pre version-bump).
- *After:* dispatch passes `refs/pull/N/head`, so monitor-oxc tests the release PR branch (main + version-bump commit).
Version-bump commits only touch `Cargo.toml` / `package.json` versions — no transformer/codegen/etc. code paths. So monitor-oxc's results are functionally identical; arguably slightly better since it tests the exact code that ships.
Dunqing