fix(ci): route merge-train dequeue ClaudeBox sessions to the target repo's mode

[AztecBot]

Problem

When a merge-train/* PR on aztec-packages-private is dequeued from the merge queue, merge-queue-dequeue-notify.yml posts to the team channel (e.g. #honk-team for merge-train/barretenberg) and kicks off a ClaudeBox session to investigate and open a fix PR.

That kickoff (.github/workflows/claudebox.yml) hardcoded CLAUDEBOX_MODE: public. So the fix session lands in public mode, where it has no access to aztec-packages-private — it can't read the dequeued PR, can't fetch the private merge-train/* branch, and can't open the fix PR. The session correctly refuses and tells a human to re-run with --private, which defeats the point of the automated kickoff.

Root cause: two things defeated claudebox-server's existing "private repo ⇒ private mode" safety net (RepoRequiresPrivateMode):

1. mode: public was sent explicitly, overriding the inference.
2. The repo sent to ClaudeBox was github.repository of the (public) workflow run, not the private repo the train actually lives on.

Fix

Thread the target repo through the kickoff so the session's mode matches where the train lives:

• ci3/merge_train_failure_slack_notify — pass --repo "$GITHUB_REPOSITORY" on both the dequeue and CI-failure kickoffs (the repo the dequeue/failure fired in is the repo the train is on).
• ci3/slack_notify_with_claudebox_kickoff — accept --repo / --mode and forward them as -f repo= / -f mode= workflow inputs. Existing callers (release_canary_slack_notify) are unaffected — the flags are optional.
• .github/workflows/claudebox.yml — add repo and mode workflow_dispatch inputs. Mode is now selected in priority order:
  1. an explicit mode input;
  2. private when the target repo is a private mirror (…-private);
  3. the existing default (vars.CLAUDEBOX_MODE || 'public') for ordinary /claudebox work on aztec-packages.

The kickoff still dispatches the public aztec-packages claudebox.yml (which holds CLAUDEBOX_API_SECRET); only the payload's repo/mode change, so a private-train dequeue now runs the fix session in private mode against aztec-packages-private.

The /claudebox PR-comment path is unchanged: for public-repo comments the target repo is public, so it stays public.

Testing

These are GitHub Actions / bash config files with no unit-test harness in this repo, so no red/green unit test is feasible. Verified:

• bash -n on both edited ci3 scripts.
• YAML parse of claudebox.yml.
• Traced the expression: endsWith('AztecProtocol/aztec-packages-private', '-private') → private; endsWith('AztecProtocol/aztec-packages', '-private') → falls through to public. Empty inputs.mode/inputs.repo (the issue_comment path) fall through to the public default.

Notes

These files mirror to aztec-packages-private, where the dequeue workflow actually runs, so the fix takes effect there once mirrored.

---

Created by claudebox · group: slackbot