chore(ci): coordinate exact candidate integration with expiring leases

[schlessera]

Refs #2111

What changed

Adds an ordinary-candidate integration controller with exclusive remote Git compare-and-swap ownership, five-minute leases, automatic minute renewal and a sixty-minute absolute cap. The shared merge path rejects stale/missing/revoked authority, validates actual selected jobs and checkout identities, requires matching release milestones and verifies the resulting squash parent/tree and main ancestry. Explicit maintainer revocation retains actor/time/reason/candidate history. Contributor, decision and agent procedures describe the same cooperative policy.

Why this shape

Implements the six maintainer rulings on #2111 without changing GitHub protection or merge permissions. A dedicated remote coordination ref supplies authoritative CAS state; fresh GitHub server time governs expiry. This is cooperative coordination with a documented direct-merge race, not a native queue or passing-result cache.

Proof

• Real concurrent Git contenders read the same absent remote ref: exactly one publishes ownership. Replacing exact force-with-lease with unconditional force makes ONLY_ONE_REMOTE_ACQUISITION_SUCCEEDS fail with both contenders granted; restored.
• Executable merge fixture uses actual commits, remote updates and merge sentinel. Missing/wrong/expired authority, changed head/base, missing/failed selected proof, wrong checkout, unexpected skip and milestone mismatch never dispatch merge. Removing the final lease check makes NO_MERGE_WITH_INVALID_AUTHORITY:revoked-during-proof fail because the revoked actor actually dispatches; restored.
• Actual confirmation controller renews against an isolated authoritative-clock fixture, releases cancellation, and cannot renew beyond the original sixty-minute cap. Positive control verifies actual squash identity and cleanup, leaving main proof explicitly pending.
• Focused controls: 19 tests / 447 assertions pass. Workspace build and strict types pass. Final bun run check:pr --base origin/main passes: 931 fast tests / 6,227 assertions and 32 affected feedback tests / 504 assertions; lint/leakage, environment and changeset gates pass. Local comparison base 5600c7273d9124796fbbe9d8c94569a1ff63c4c3.
• CI-only source and repository procedure changes; no published package or public CLI/MCP schema changes, so no changeset.

Checklist

• Focused preflight passed; selected hosted candidate qualification remains outstanding.
• All issue acceptance criteria met; remaining evidence is listed below.
• PR and advanced issue assigned release 0.44.0 and read back.
• No consumer-visible package change; no changeset needed.
• Public text and source pass the leakage gate.
• Public integration contract unchanged.
• Decision, contributor and agent procedures updated.

Anything left open

Draft: a controlled hosted confirmation/merge and competing-candidate demonstration, actual integrated-tree/main proof and before/after queue/execution/cancellation measurements remain required. No shared GitHub coordination state has been acquired or published by these local fixtures. Existing queued proof remains preserved; this implementation is not evidence of measured CI savings or #2111 completion.

The controller currently supports ordinary main-targeted candidates only. Native prefix integration must be qualified separately with #2141 before native candidates can use this path. Successful ordinary squash exits 2 to require actual automatic-main job/checkout reconciliation even if a run summary is green. No reservation, freshness or proof waiver is inferred.

Current local qualification — 2026-10-17

Claim e1849-2111-qualification-r2-20261017 integrates current main 0d780605fe1ea9a281cce947b1f0074f3f3e7acc at c99c78a2b32054144c57467e664d5f2f993cb46d. The existing twelve-file ordinary-candidate controller/procedure scope remains; native-prefix qualification stays separate. Own frozen dependencies, Bun 1.4.3, owned disk-backed temporary data and ordinary-UID route-free namespace with dropped capabilities.

Current focused proof passes 20 tests / 457 assertions. Two fresh meaningful mutations fail as intended: unconditional remote force grants both real Git contenders and fails ONLY_ONE_REMOTE_ACQUISITION_SUCCEEDS ([true,true] instead of [true,false]); omitting the final live authority check actually dispatches a revoked actor's merge and fails NO_MERGE_WITH_INVALID_AUTHORITY:revoked-during-proof (expected false / received true). Both source files are restored byte-for-byte; the full focused set then passes 20 / 457 again. Required actual committed-head preflight passes all contribution gates, 956 fast tests / 6,332 assertions and 35 affected feedback tests / 521 assertions. These are owned local-fixture receipts, not a shared GitHub reservation or hosted performance gain.

#2197 remains draft behind #1943 and the prepared #2188/#2176 candidates. No canonical remote coordination ref, competing expensive confirmation or unqualified merge was started by this preparation. Remaining original criteria are real hosted/controller and competing-candidate evidence, exact current-candidate proof, actual integrated-tree/main reconciliation and honest queue/execution/cancellation measurements. Retain original source-attributed costs and the controller's ordinary-only boundary; no reservation lifecycle or issue completion is inferred from local controls alone.

Current source-validity blocker — 2026-10-17

Blocked by #2365

The independently run existing tests/native-diagram-inputs.test.ts fails on this exact head c99c78a2b32054144c57467e664d5f2f993cb46d: COMPLETE_NATIVE_QUALIFICATION_WITHOUT_DOCKER_OR_IMAGE_LOOKUP expects 859, receives undefined (0 pass / 1 fail, 2 assertions, 92 ms). This candidate legitimately changes the pinned CI-proof source to add the structured selected-proof receipt; the conservative native binder refuses that pin drift. #2365 owns the self-test's incorrect unconditional current-source positive assumption. Do not refresh qualification pins or weaken refusal merely to make the test pass.

The 20/457 focused baseline/restoration, two intended live mutations, and 956/6,332 fast plus 35/521 affected preflight remain passing at their actual source. Default import-graph feedback does not capture this file-read/pinned-source dependency, as its documented boundary states. Complete selected hosted proof would include the known failing self-test, so no expensive confirmation or shared remote reservation is requested for this input.

#2197 remains draft and 0.44.0 remains assigned. Resume after a source-valid positive/negative self-test fixture correction: integrate relevant changes, rerun that guard plus affected controller/preflight proof, then qualify the actual hosted controller/competition, exact candidate, merge/main and cost criteria still listed above. Preserve native-prefix exclusions and every authority/proof gate. Claim e1849-2111-qualification-r2-20261017 is released after fresh ownership readback; the complete integrated branch/PR is saved. This is a known verification prerequisite, not a new policy question or a local proof waiver.