ci: schedule bounded hourly PR maintenance (stacked on #569)

[seonghobae]

Summary

Add a repository-owned hourly heartbeat that delegates review-feedback repair to the protected central ContextualWisdomLab/.github control plane instead of copying the repair engine into this product repository.

• Runs at minute 11 every hour and on manual dispatch.
• Inspects up to 100 open main PRs but permits at most one repair dispatch per heartbeat.
• Enforces a one-hour same-head retry floor.
• Uses non-cancelling concurrency so a later heartbeat does not terminate legitimate work.
• Keeps the caller GITHUB_TOKEN read-only and uses only the existing central scheduler credentials.
• Does not receive NVIDIA_NIM_API_KEY; the separately reviewed central OpenCode worker owns NIM model execution.
• Does not use COPILOT_GITHUB_TOKEN.
• Preserves exact-head checks, independent non-author approval, and branch protection.

Dependency boundary

This PR is temporarily stacked on fix/tool-execution-fallbacks-567 / PR #569. The previous main-based merge ref failed SAST only on five pre-existing provider/TLS/SQL findings in protected main; none were introduced by this four-file scheduler slice. PR #569 owns the audited source-level/Semgrep boundary for those findings. Do not duplicate unrelated suppressions in this PR.

After #569 reaches protected main, retarget this PR to main without changing its product head, then regenerate every exact-head check and review. No predecessor-base result transfers after retargeting.

Documentation

docs/doctoring/hourly-pr-maintenance.md records cadence, source-of-truth ownership, credential/model boundaries, fail-closed behavior, rollback, and APA 7th references to the GitHub Actions and repository-dispatch contracts.

Verification

• python3 -m pytest -q tests/test_hourly_pr_maintenance_workflow.py — 4 passed
• PyYAML parse and contract assertions for schedule, concurrency, permissions, target, bounds, and secret exclusions
• Extracted dispatch shell block validated with bash -n
• python3 -m compileall -q tests/test_hourly_pr_maintenance_workflow.py
• git diff --check

The former main-based exact head had Tests, Security, Security Scan, and Fuzz success. Its SAST failure was the five inherited findings listed above and is diagnostic only after this base change.

Activation boundary

GitHub scheduled workflows execute from the default branch. This hourly loop is therefore not considered active until #569 and this PR are merged in dependency order and the required dispatch credential exists. A non-204 central dispatch response fails closed and remains visible in Actions.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a6c6d3b9-65f0-4fc9-ae54-d9e14bbc46d7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent Perform an independent exact-head review of 72809335262d469ad4985038a46b9aa7cde2f5ae. Verify the hourly central-dispatch contract, least-privilege credential boundary, dependency-free regression tests, and terminal required checks. Submit a formal review only; do not update the branch or merge.