CI: regen upstream of ci (build→regen→ci→deploy) + heal auto-fixes drift on PRs

[gunbai-bot]

Completes the regen-upstream restructure and makes the generated-artifact heal a general convenience (operator-directed 2026-07-23).

What changed

• Regen extracted into its own job: `build → regen → ci → deploy`. `ci` now `needs: [build, regen]` (was `[build]` with regen as an inline step). Reuses main's existing `GithubActionsCiRegenJob` gate lane (`project_ci_regen_job_gates` → RegenVerifyGate + SelfHostStalenessGate) rather than duplicating it — main modeled the gate surface, this extracts the actual job.
• Heal runs on PRs too (`pull_request || push`, was main-push-only): checks out the triggering branch head (`ref: ${{ github.head_ref || github.ref_name }}`) and pushes the regeneration back to that branch (`HEAD:${{ github.head_ref || github.ref_name }}`), so drift is auto-repaired on the PR branch before it reaches main. contents:write stays scoped to this one job (least privilege).
• Robust `git add`: each registered artifact path is `[ -e ]`-guarded with a counted skip echo — a registered-but-absent artifact (the host-convergence circuit: kill the paper transport (P0) + PerSlotMemoryCap reconcile loop, live-wired (P1/P1a) #7121 `FleetConvergeArtifact` incident, which was exit-128ing the heal on every main push) can no longer fail the whole heal.
• Absorbs host-convergence circuit: kill the paper transport (P0) + PerSlotMemoryCap reconcile loop, live-wired (P1/P1a) #7121 (fleet-converge removal) and Floor DECISIONS onto v2 .dag (XL): discovery producer + naming-hygiene + compile-clean scope re-pointed; Rust arms DELETED; dual-run equivalence + RED receipts; negative seed delta #7090 via merge.

Verified locally (direct binary)

• `ci.yml` regenerated: build → regen(needs build) → ci(needs build,regen) → deploy; heal on pull_request||push with branch checkout + branch push + guarded add.
• Drift gate `ExitSuccess` (ci.yml at fixed point); heal witness `true` (5 discriminating controls: enrollment, needs-build-not-ci, pr_and_push guard, scoped write, artifact-only + existence-guarded + branch-aware push); fixed-point loop-safety witness `true`.

Known caveat

The drift gate still lives inside `ci`, so the first run that observes drift shows `ci` red on its pre-heal snapshot (a GITHUB_TOKEN push doesn't re-trigger CI); the branch is auto-fixed and main is green. Making even that first run green means moving drift out of the ci floor (a merge-admission change) — left as a follow-up.

🤖 Generated with Claude Code

[gunbai-bot]

Addressed both findings from cursor review 41904 (both valid):

1. roadmap_authority.dag ts-loop-selfheal row updated — it now describes the PR+push heal, the branch-head checkout, the branch-aware push, and the existence-guarded git add; ROADMAP.md regenerated to match.
2. Added heal_checks_out_triggering_branch() to the witness suite — it folds the heal job's steps and reds unless one checks out ci_heal_branch_ref_expr (github.head_ref || github.ref_name), so a regression to the default merge ref is now caught. Witness green by execution (6 discriminating controls).
   Landed in 04ec0ae. — sent from sleek-crane-70

[gunbai-bot]

review 41924 — both stale strings fixed and ci.yml regenerated (drift gate ExitSuccess):

• ci_workflow.dag heal commit-push step name: "…to main…" → "…to the triggering branch…"
• ci_spec.dag regen notice title: "…folded into ci job" → "…own regen job upstream of ci"

Pushed as 7872b56. These are telemetry-only, no behavior change.

— sent from sleek-crane-70