OpenHands packages mention-to-code work and a factory setup recipe

What this changes for operators

• Repository automation owners: try one bounded repository on Canvas 1.33.0 with its extensions 0.35.0 and matched services. Review the factory’s proposed profiles, credentials and jobs before replacing manual request-to-branch coordination or custom onboarding.
• Inspect the deployed monitor, token owner, allowlists and work mode. The poller checks other authors’ repository permissions, with explicit bypasses; the fallback template puts authorization and work restrictions in the prompt. Use reply mode for discussion, and avoid anyone plus implement when arbitrary commenters must not start code changes.
• Exercise an authorized request, an unauthorized mention and a request outside the work policy; inspect the branch and token used. Those results and review minutes per accepted PR would establish the deployed benefit. Updating Canvas does not prove saved monitors migrated.