auditor: route every workflow through commit-via-pr (no direct pushes to main)

[xiaolai]

Supersedes #299. Completes the "nothing pushes to main directly" migration #299 opened on 2026-06-05 but never landed — and fixes the reason a naive version would have made things worse.

Why #299 couldn't just be rebased

On main today, only auditor-track.yml uses commit-via-pr.sh; the other ~15 commit sites across 12 workflows still push directly to main. #299's June diff targeted the June versions of those files (all rewritten since), so it's unrebaseable — and because GitHub "mergeable" only means no textual conflict, merging it as-is would have migrated a few June-era push points and left the newer ones direct: a partial migration that silently fails the goal.

The real blocker: the PR flow had no conflict handling

The repo already had two commit paths:

• git-push-with-retry.sh — direct push to main, with rebase+resolve reconciliation (robust, no pileup).
• commit-via-pr.sh — bot-PR flow, no reconciliation.

Moving everything to the PR flow without reconciliation recreates the exact pileup the stale track: PRs demonstrated (two bot PRs touching events.jsonl/repos.json conflict; the second stalls). So this PR gives the PR flow the same reconciliation the direct path already had.

What's here

commit-via-pr.sh — reconcile loop. After enabling auto-merge, watch the PR briefly; on DIRTY, rebase the bot branch onto latest main via the shared resolve-merge-conflicts.sh (same resolver, same conflict-stage semantics as git-push-with-retry.sh), force-push, re-assert auto-merge. Guards the empty-after-rebase case (commit already upstream → close the redundant PR rather than leave a zero-commit stuck PR). Fail-soft throughout — a stuck PR never fails the workflow that opened it.

auditor-unstick-bot-prs.yml + unstick-bot-prs.sh — janitor. Every 30 min, reconciles any bot PR left DIRTY after its opening job exited (a sibling merging asynchronously) — the safety net the in-run loop structurally can't cover. Deterministic, no LLM.

20 commit sites migrated across 12 workflows: git commit + (git-push-with-retry.sh | inline push-retry loop) → git add + commit-via-pr.sh. PAT_TOKEN added to each step's env; dead git config/remote set-url removed.

Untouched by design: auditor-track.yml (already migrated); auditor-cite-exemplars.yml (human-gated feature-branch PR, not a main push); the refine-rules refinement PR (only its separate log-to-main push was migrated).

One behavior to know: sequential calls

Jobs that commit twice (case-study always; audit when security-blocked) chain commits — the second PR contains the first's commit. This converges correctly (append-only logs union, registry 3-way merges, idempotent at merge regardless of order); the one hazard (rebase empties a branch) is handled by the empty-PR guard. Documented in the commit-via-pr.sh header.

Verification

• All workflow YAML parses; both scripts bash -n clean.
• No residual direct-to-main pushes in auditor workflows (git-push-with-retry.sh survives only in the out-of-scope nlpm-self-check.yml).
• Every migrated step has PAT_TOKEN.
• Python unittest suite green.

Recommendation

Merge this, then close #299 as superseded. This is a large, pipeline-wide change with real blast radius — please review the reconcile loop and the janitor before merging. Nothing here is auto-merged.