fix(ci): fleet-branch push triggers + dispatcher claim prefilter (#463)

* fix(ci): fleet-branch push triggers close the absent-check gap; dispatcher claim prefilter

PROVEN with API receipts: when the PM squash-merges a subtask PR into a
branch that is itself another PR's head (GitService.merge_pull_request →
GitHub's Merge API), the pull_request synchronize webhook fires
unreliably (1 of 3 in the live sample) while plain push events fired
100% — so PR heads sat with ABSENT required checks that three review
rounds mistook for green. CI, CodeQL, e2e-smoke, and panel-ci now also
trigger on push to the fleet's branch types, deduped by a concurrency
group keyed on head_ref||ref_name so a branch that is also a PR head
never double-runs.

Dispatcher churn: _route_unassigned_pm_task consults the claim guards'
own predicate (TaskService.is_pending_claim_blocked, a public wrapper —
no duplicated SQL) before routing, so dependency- or sequence-held
tasks skip the tick with zero HTTP claim round-trips; fails open so a
DB hiccup degrades to the old behavior.

* chore(docs): reflow hard-wrapped prose inherited from the six-PR merge train

* chore(foundation): regenerate lifecycle artifacts; reflow inherited prose

---------

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

.github/workflows/ci.yml

@@ -4,6 +4,21 @@ on:
   push:
     branches:
       - master
+      # Fleet task branches (GitService push/merge, roboco/services/git.py).
+      # A revision commit that lands on a PR's head via the merge API
+      # (squash-merging a subtask PR into a parent branch) doesn't reliably
+      # fire `pull_request`'s synchronize trigger for the PR that already
+      # has that branch as its head — proven live on PR #406, where two
+      # revision merges left CI/CodeQL absent (not red) while `push` and
+      # `pull_request_target` both fired for the same ref update. A real git
+      # push always fires `pull_request`; this redundant trigger (paired
+      # with the concurrency group below) closes the gap for merge-API
+      # revisions without double-running when both events land.
+      - 'feature/**'
+      - 'bug/**'
+      - 'chore/**'
+      - 'docs/**'
+      - 'hotfix/**'
     paths:
       - 'roboco/**'
       - 'agents/**'
@@ -35,6 +50,17 @@ on:
       - '.github/workflows/ci.yml'
   workflow_dispatch:
 
+# A fleet branch that's also an open PR head can get both a `push` and a
+# `pull_request` run for the same commit; cancel the older one instead of
+# burning two runners on identical work. `head_ref` (set only for
+# pull_request) and `ref_name` (the short branch name, valid for push) both
+# resolve to the SAME branch name, so the two event shapes share one group —
+# plain `github.ref` would NOT (it's `refs/pull/<n>/merge` for pull_request
+# vs `refs/heads/<branch>` for push, so it'd never collapse them).
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
 jobs:
   quality:
     name: Python quality gate

.github/workflows/code-ql.yml

@@ -2,7 +2,12 @@ name: CodeQL
 
 on:
   push:
-    branches: [master]
+    # master plus fleet task branches: `pull_request`'s synchronize trigger
+    # doesn't reliably fire when a revision lands on a PR head via the
+    # merge API (see ci.yml for the live-proven receipts); `push` does, so
+    # it's the redundant trigger for a required check that must not go
+    # ABSENT on a fleet-authored PR revision.
+    branches: [master, 'feature/**', 'bug/**', 'chore/**', 'docs/**', 'hotfix/**']
     paths:
       - 'roboco/**'
       - 'agents/**'
@@ -25,6 +30,17 @@ on:
     - cron: '0 0 * * 1'
   workflow_dispatch:
 
+# A fleet branch that's also an open PR head can get both a `push` and a
+# `pull_request` run for the same commit; cancel the older one instead of
+# burning two runners on identical work. `head_ref` (set only for
+# pull_request) and `ref_name` (the short branch name, valid for push) both
+# resolve to the SAME branch name, so the two event shapes share one group —
+# plain `github.ref` would NOT (it's `refs/pull/<n>/merge` for pull_request
+# vs `refs/heads/<branch>` for push, so it'd never collapse them).
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})

.github/workflows/e2e-smoke.yml

@@ -4,6 +4,14 @@ on:
   push:
     branches:
       - master
+      # Fleet task branches: `pull_request`'s synchronize trigger doesn't
+      # reliably fire when a revision lands on a PR head via the merge API
+      # (see ci.yml for the live-proven receipts); `push` does.
+      - 'feature/**'
+      - 'bug/**'
+      - 'chore/**'
+      - 'docs/**'
+      - 'hotfix/**'
     paths:
       - 'roboco/**'
       - 'alembic/**'
@@ -25,6 +33,17 @@ on:
       - '.github/workflows/e2e-smoke.yml'
   workflow_dispatch:
 
+# A fleet branch that's also an open PR head can get both a `push` and a
+# `pull_request` run for the same commit; cancel the older one instead of
+# burning two runners on identical work. `head_ref` (set only for
+# pull_request) and `ref_name` (the short branch name, valid for push) both
+# resolve to the SAME branch name, so the two event shapes share one group —
+# plain `github.ref` would NOT (it's `refs/pull/<n>/merge` for pull_request
+# vs `refs/heads/<branch>` for push, so it'd never collapse them).
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
 jobs:
   e2e-smoke:
     name: e2e lifecycle smoke (scripted agents)

.github/workflows/panel-ci.yml

@@ -4,6 +4,14 @@ on:
   push:
     branches:
       - master
+      # Fleet task branches: `pull_request`'s synchronize trigger doesn't
+      # reliably fire when a revision lands on a PR head via the merge API
+      # (see ci.yml for the live-proven receipts); `push` does.
+      - 'feature/**'
+      - 'bug/**'
+      - 'chore/**'
+      - 'docs/**'
+      - 'hotfix/**'
     paths:
       - 'panel/**'
       - '.github/workflows/panel-ci.yml'
@@ -15,6 +23,17 @@ on:
       - '.github/workflows/panel-ci.yml'
   workflow_dispatch:
 
+# A fleet branch that's also an open PR head can get both a `push` and a
+# `pull_request` run for the same commit; cancel the older one instead of
+# burning two runners on identical work. `head_ref` (set only for
+# pull_request) and `ref_name` (the short branch name, valid for push) both
+# resolve to the SAME branch name, so the two event shapes share one group —
+# plain `github.ref` would NOT (it's `refs/pull/<n>/merge` for pull_request
+# vs `refs/heads/<branch>` for push, so it'd never collapse them).
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
 jobs:
   panel:
     name: Panel (Next.js)