ci(OMN-14160): add call-occ-autobind caller to omnibase_core

[jonahgabriel]

Closes OMN-14160.

Summary

• omnibase_core had no OCC-autobind caller workflow.
• It never had one on any ref.
• Its Fix section names omnibase_core first of six destinations.
• The 2026-07-24 fan-out reached the other five and skipped this one.
• The ticket was marked Done anyway.
• It was reopened on 2026-09-19.
• The exclusion was deliberate on 2026-07-23.
• It is recorded in the sibling caller header.
• The premise was that the autobind path was being retired.
• Five repositories received that same caller the next day.
• The premise lapsed and was never revisited.
• The sibling header is corrected in this change.

What changed

• Add the OCC-autobind caller workflow to omnibase_core.

• Port the caller from the omnibase_infra shape.

• Include the manual replay entrypoint.

• Add the precheck script it runs.

• Add a test for both.

• Add an updated pin assertion.

• Add a workflow budget waiver.

• Bump the package version because a source file changed.

• Correct the sibling caller header.

• Use the stricter precheck copy.

• The stricter variant refuses to decide on a malformed payload.

• It does not read a malformed payload as open and non-draft.

• The caller is not a required status check.

• It publishes a command and cannot block a merge.

• Fix a raw process environment read in the test file being edited.

• Migrate that read to the typed bootstrap.

• Over the last 200 change-control pull requests, seven repositories receive autobind-flavoured evidence companions.

• omnibase_core receives zero.

• Over the same window, omnibase_core received five companion-effect mints.

• The five are the positive control.

• The minter reaches this repository.

• The zero is the missing caller.

• With no autobind, the evidence-source trailer is never bound.

• An unstamped pull request burns the full 1500 second preflight eligibility budget.

• It fails closed.

• This repository instantiates the preflight reusable in 43 workflows.

Proof

• This pull request's own autobind job runs on it.
• A companion minted for this pull request is the readback.

Local verification

• pre-commit run --files <the eight changed files> clean, no hook modified a file on the final pass.
• pytest tests/ci/test_occ_manual_replay_entrypoint.py tests/ci/test_workflow_uses_refs_resolve.py tests/validation/test_pull_request_workflow_ratchet.py -> 52 passed.
• mypy --strict clean on the new script; ruff format and ruff check clean on all changed Python.
• The advisory-job gate was run locally against this tree at the sha this repository pins, and passes. A positive control was taken: renaming the replay job to a verification-shaped id makes the same run report UNENFORCED_VERIFICATION_JOB against this exact file, so the pass is a measurement and not an absence.
• The updated pin assertion was likewise controlled: run against the pre-change tree its map yields one entry, so the new expectation is genuinely red without the caller.
• The environment-reader validator passes in both modes, and its inventory goes 328 findings / 106 paths -> 326 / 105 with unassigned=0 stale=0.

Notes for the reviewer

• The lab-first step for a CI-only change of this shape is the workflow running on this pull request itself. There is no runtime or lane mutation here.
• The reusable now also resolves on omniclaude main, so the OMN-14812 re-pin is unblocked. It is deliberately not taken here: that is a fleet-wide change across seven callers and does not belong in a fan-out.
• The sibling call-occ-companion-effect.yml workflow-budget waiver expires 2026-09-20, and its own text says not to renew it a third time without landing the migration or an explicit operator call. That is OMN-16359 and is flagged, not touched.

PR body drafted via onex delegate on the local chain, receipt 92a8d9c7-1a36-464d-8947-f6911779d987, correlation 6f255217-227d-4b7d-9360-770734009295, model Qwen3.8-27B, quality 0.9.

Evidence-Ticket: OMN-14160
Evidence-Source: OCC#10421

[onexbot-occ-writer]

No OCC evidence companion was minted for this PR.

this PR is already bound to OCC#10421; its evidence companion exists and nothing needs authoring

To clear this: Nothing to do — the companion already exists.

Reported by node_occ_companion_effect (decline code already_bound, OMN-16665). This decision was made against the PR's LIVE state at compute time, not at publish time — a green publisher job only means the command reached the broker.