ci: fix production required-check race

[fermatmind]

What changed

• poll the exact deploy SHA for the four required checks for up to 12 minutes, using the newest run for each check name
• fail closed on explicit check failure or timeout, then revalidate main membership after checks complete
• treat superseded automatic revisions and policy-blocked risky revisions as neutral skipped deploys
• preserve SHA-bound manual authorization and production environment protection for risky deploys

Why

Staging can complete before required CI checks start or finish. The previous one-shot lookup falsely failed production automation even when the exact SHA checks later succeeded.

Validation

• pnpm lint . --max-warnings=0
• pnpm typecheck
• deploy/security focused contracts: 5 files / 72 tests
• pnpm test:contract: 4 shards / 4,127 tests passed
• production workflow YAML parse
• NEXT_PUBLIC_SITE_URL=https://fermatmind.com NEXT_PUBLIC_API_URL=https://api.fermatmind.com pnpm build
• git diff --check
• exact six-file scope validation

Deferred

• no staging workflow, secrets, deployment scripts, CMS, SEO runtime, or server state changes
• no production deploy is triggered by this PR

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7570ff7af5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Move stale-run skip before the hard failure

When a staging run for commit A finishes after main has already advanced to commit B, the guard never reaches this new neutral-skip branch: the earlier deploySha !== latestMainSha check near the start of the script still calls core.setFailed and returns. Because this branch only covers main changing after the required-check polling begins, the common superseded workflow_run case remains a failed production workflow instead of the intended skipped deploy.

Useful? React with 👍 / 👎.