fix(ci): a push to main reuses x86-main + determinism only from a real merge-queue run on the same sha (#4748)

[noahgift]

Summary

A push to main used to run x86-main and determinism in full on the sha the merge queue had just passed. mg-reuse reused only on merge_group. workspace-test already reuses the queue's result on the same sha (T36). This does the same for x86-main and determinism. It reuses them only when the queue run on that sha ran them for real, not when that run itself reused them.

Closes #4748.

What changes

• scripts/ci_mg_reuse.sh adds decide_push / resolve_push. On a push it reuses (x86=det=1) only when every check below holds:

  • the push is to refs/heads/main;
  • the pushed commit S has one parent, and before is that parent;
  • the newest completed ci.yml merge_group run on S came from gh-readonly-queue/main/pr-N-<parent>;
  • in that run, x86-main, determinism, gate and ci / gate succeeded, and x86-main-advisories was skipped. A skipped advisory job proves x86-main ran for real.

  Every other input, and every failed lookup, gives 0 and runs the jobs. mac is never reused on a push. There are 14 # R-PUSH* refusal markers.

• .github/workflows/ci.yml: mg-reuse also runs on a push to main. Both MG-REUSE-VERDICT copies accept push:success:1:1:success, and on a push the advisory job must still pass.

• scripts/check_ci_push_reuse.sh: the existing guard now covers the third subject script. 106 checks pass. Its mutation set kills every # R-* refusal (29/29), checked against an unmutated control copy.

• Contracts.

  • apr-required-checks-v1.yaml goes to v1.3.0, adds RC-OB-013 and RC-F-013, and rewrites RC-OB-011 and RC-F-011 to name the push row.
  • release-schedule-06x-v1.yaml updates RS0-INV-008.
  • contracts.nt is updated.

• Roadmap entry: docs/roadmaps/entries/PMAT-4748.yaml.

Evidence

• I checked the jobs of a real merge-queue run. x86-main, determinism, gate and ci / gate succeeded, and x86-main-advisories was skipped. That is the exact shape the push key requires.
• bash scripts/ci_mg_reuse.sh --self-test: 78 passed, 0 failed. Seven of those rows are push verdict rows.
• bash scripts/check_ci_push_reuse.sh: OK.
• pv validate contracts/apr-required-checks-v1.yaml: 0 errors, 0 warnings.
• cargo test -p aprender-contracts --lib on 934cdbb: 2290 passed, 0 failed, 5 ignored.
• cargo fmt --all -- --check and cargo deny check advisories: clean.

Review

This changes what a gate accepts, so it needs a non-author quorum round on the final commit, two non-author reviews, and green CI.

• Quorum: AGREED 3/3. gemini-3.1-pro-high, claude-sonnet-5-5 and claude-haiku-4-5 all passed on 2abe1d7. The receipt is at docs/audits/quorum-PMAT-4748.json. The only commit after it adds the receipt itself.
• Earlier rounds. In round 4 the Gemini lane failed because RC-OB-011 was stale. 2abe1d7 fixes that. One earlier round got no verdict from one lane, because that lane hit a transport error.
• Advisory apr lane: unavailable (executor busy). It is advisory only.

🤖 Generated with Claude Code

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=4884 head=7cf2d072712f2413a2b96a93ef73382677c917ad verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.

[noahgift]

quorum-review (AD-04): NOT agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-4748",
 "head": "015ed1c1a0dbd78a440238a8cc744381c2663cc0",
 "width": 3,
 "executor": "agy",
 "agreed": false,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "PASS",
   "findings": 0
  },
  {
   "lane": 2,
   "verdict": "NO-VERDICT",
   "findings": 0
  },
  {
   "lane": 3,
   "verdict": "PASS",
   "findings": 0
  }
 ]
}

[noahgift]

quorum-review (AD-04): three PASS — agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-4748",
 "head": "015ed1c1a0dbd78a440238a8cc744381c2663cc0",
 "width": 3,
 "executor": "agy",
 "agreed": true,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "PASS",
   "findings": 0
  },
  {
   "lane": 2,
   "verdict": "PASS",
   "findings": 0
  },
  {
   "lane": 3,
   "verdict": "PASS",
   "findings": 0
  }
 ]
}