fix(notifications): one duplicate-tolerant role lookup for every singleton-role site

The duplicate-CEO-row fix landed on one call site but three identical
bare 'select(...).where(role == ...)' + scalar_one_or_none() lookups
remained in the orchestrator (auditor + two CEO), each still raising
MultipleResultsFound under the same condition. All five sites now route
through a shared get_agent_by_role helper (earliest-created row wins).
The five event-bus notification handlers also thread task_title so a
revived producer renders titles instead of #id8 (protocol signatures
updated to match the service), the pull_request CI trigger mirrors the
push trigger's paths so a fork PR touching only those paths still runs
CI, and a stale a2a comment about auditor/pr_reviewer lacking read_a2a
is corrected.

.github/workflows/ci.yml

@@ -62,6 +62,14 @@ on:
       - 'uv.lock'
       - 'alembic.ini'
       - '.github/workflows/ci.yml'
+      # Kept identical to the push trigger's paths above so an external-fork
+      # PR touching only these (panel/docs-only, motion-only, ...) still
+      # fires CI instead of merging on a false "no checks required" green.
+      - 'panel/**'
+      - 'CLAUDE.md'
+      - 'CHANGELOG.md'
+      - 'docs/**'
+      - 'motion/**'
   workflow_dispatch:
 
 # A fleet branch that's also an open PR head can get both a `push` and a