feat(ci): acknowledge new pull requests automatically

.github/pr-acknowledgement.md

@@ -0,0 +1,34 @@
+<!--
+  Posted automatically on every newly opened pull request by
+  .github/workflows/pr-acknowledgement.yml
+
+  EDIT THIS FILE to change what contributors are told. Blank it out to stop
+  posting acknowledgements entirely — no workflow change needed.
+
+  Keep it short, and keep it honest about what happens next. A promise of a
+  timeline you will not meet is worse than no acknowledgement at all.
+  Remove the review-status section below the moment it stops being true.
+-->
+
+Thanks for opening this — it has been seen, and it is queued.
+
+This note is automated, but it is not a brush-off: it exists so you know where your PR stands instead of having to guess from silence.
+
+**Current review status: reviews are running behind.** We are finishing release-critical work for `0.9.1-rc.1` — a coordination daemon that changed how the whole system runs, and the root-cause fix for a severe Windows memory leak ([#581](https://github.com/DeusData/codebase-memory-mcp/issues/581)) that could exhaust a machine's commit charge over hours. Those changes cross the memory allocator, thread lifecycle, and the store-resolution path that every tool call runs through, so merging other work on top of them while they settle would leave neither change trustworthy. The full explanation is in [discussion #1144](https://github.com/DeusData/codebase-memory-mcp/discussions/1144).
+
+What that means for this PR, concretely:
+
+- **It will not be closed for inactivity.** No stale bot touches pull requests here.
+- It may sit longer than it should before a human reads it. That is on us, not on you.
+- Review resumes once the release path is clear.
+
+Things that will genuinely speed it up whenever review does happen:
+
+- **Keep it rebased** on `main` — the tree is moving quickly right now, and a conflicting branch cannot be reviewed as the diff you intended.
+- **Get CI green**, or say which failures you believe are pre-existing.
+- **Keep the change to one claim.** Bundled features and refactors get split before they get merged, which costs you a round trip.
+- Every commit needs a sign-off (`git commit -s`) — CI enforces DCO.
+
+If this fixes a bug, a reproduction we can run is worth more than a description of the symptom.
+
+Thanks for contributing, and sorry in advance for the wait.

.github/workflows/pr-acknowledgement.yml

@@ -0,0 +1,67 @@
+name: PR acknowledgement
+
+# Posts one acknowledgement comment when a pull request is opened, so a
+# contributor learns the current review status immediately instead of inferring
+# it from silence.
+#
+# The message text lives in `.github/pr-acknowledgement.md`. Edit that file to
+# change what is said; blank it (or delete it) to turn acknowledgements off
+# without touching this workflow. No code change is needed to switch it.
+#
+# SECURITY — this uses `pull_request_target`, which runs against the BASE repo
+# with a token that can write. That is required: a `pull_request` trigger gives
+# fork PRs a read-only token, so commenting on exactly the contributions we most
+# want to acknowledge would fail.
+#
+# The safety rule that makes it sound: this job NEVER checks out, builds, or
+# executes pull-request code. `actions/checkout` here resolves to the base
+# commit (the default under `pull_request_target`), and it is used only to read
+# the message file out of our own tree. Do not add a `ref:` pointing at the PR
+# head, and do not add a build step. Nothing from the PR is interpolated into a
+# shell command either — the body comes from a file, and the PR number is passed
+# through the environment rather than expanded inline.
+
+on:
+  pull_request_target:
+    types: [opened]
+
+permissions:
+  contents: read
+
+jobs:
+  acknowledge:
+    runs-on: ubuntu-latest
+    # Bots do not read comments, and acknowledging our own PRs is noise.
+    if: >-
+      github.event.pull_request.user.type != 'Bot' &&
+      github.event.pull_request.author_association != 'OWNER'
+    permissions:
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          # Base commit only — never the PR head. See the security note above.
+          persist-credentials: false
+
+      - name: Post acknowledgement
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          MESSAGE_FILE=.github/pr-acknowledgement.md
+
+          if [ ! -f "$MESSAGE_FILE" ]; then
+            echo "No $MESSAGE_FILE in the base tree — acknowledgements are off."
+            exit 0
+          fi
+
+          # An empty or whitespace-only file is the documented off switch.
+          if [ -z "$(tr -d '[:space:]' < "$MESSAGE_FILE")" ]; then
+            echo "$MESSAGE_FILE is blank — acknowledgements are off."
+            exit 0
+          fi
+
+          gh pr comment "$PR_NUMBER" --repo "$REPO" --body-file "$MESSAGE_FILE"
+          echo "Acknowledged PR #${PR_NUMBER}."