fix(poll): report a cancelled gating check as unverified, not green

[tend-agent]

A check run that is COMPLETED without a usable conclusion matched neither bucket reduce_rollup derived — pending is status != "COMPLETED", failed is COMPLETED plus a conclusion in RED_CONCLUSIONS — so _settle saw an empty pending, and poll printed green: every gating check … settled green with exit 0 over a check that never produced a result. The ordinary trigger is concurrency: a second push to a branch cancels the first head's run, and a session accountable for that first commit is told its long job passed. approval reached approve: no failing check by the same route.

reduce_rollup now returns a third unverified bucket, and green is the allowlist rather than the remainder: GREEN_CONCLUSIONS = {"SUCCESS", "NEUTRAL", "SKIPPED"}, and any other conclusion on a COMPLETED check that isn't red is unverified. That covers CANCELLED and STALE, a COMPLETED check carrying no conclusion, and any conclusion GitHub adds to CheckConclusionState later — deriving green by subtraction is what let the original false green through, so the unrecognized case is fail-closed by construction rather than by keeping a second list current.

poll names those checks and exits 2 — which /tend-ci-runner:monitor-ci already reads as "unverified, not green" — and names them beside a red or cap-hit verdict too, so the reader knows the picture is partial. approval keeps its existing policy of approving over a check that never ran, since a check that reached no verdict cannot withhold on its merits, but now prints it as unverified instead of silently; references/approving.md describes the widened meaning.

Supersession is unchanged and still decides first: where a rerun concluded at the same SHA, the latest run of each (name, workflow) wins and nothing is left unverified. Status contexts route exactly as before — SUCCESS green, ERROR/FAILURE red, PENDING/EXPECTED never COMPLETED.

Verification

Six test cases in generator/tests/test_poll_scripts.py fail on main and pass here: test_cancelled_is_not_a_verdict (parametrized over CANCELLED and STALE, previously asserting exit 0 for a cancelled check, now exit 2 with the check named), test_cancelled_beside_a_real_failure_still_reads_red, test_approval_names_a_cancelled_check_it_approves_over, and test_a_conclusion_in_neither_set_is_not_green (parametrized over an absent conclusion and one GitHub does not emit today).

Two more pass on main and guard against this change over-reaching: test_cancelled_replaced_at_the_same_sha_is_green pins that a cancellation superseded by a green rerun at the same SHA still reads green, and test_non_blocking_conclusions_still_read_green pins NEUTRAL and SKIPPED, which nothing covered before.

The file's 44 tests pass, as does the full Python suite apart from the two test_refresh_consumers.py cases that need PyPI DNS. pre-commit run --all-files is clean.

The mechanism and the live reproduction are in #1322, against poll_pr_checks.py.

Closes #1322 — automated triage

[tend-agent]

reduce_rollup still derives green by subtraction: unverified is an allowlist of CANCELLED/STALE, so a COMPLETED check whose conclusion is outside both sets — one GitHub adds to CheckConclusionState later, or a null conclusion that reaches the reducer as "" — lands in neither bucket, and poll prints green: every gating check … settled green over it. That is the same false green this PR fixes, one conclusion value away. test_terminal_non_success_conclusions_count_red's own docstring already names the shape: "left out of both buckets it would read as green".

Naming the passing set instead is the same amount of code and closes the default:

GREEN_CONCLUSIONS = {"SUCCESS", "NEUTRAL", "SKIPPED"}
...
and context["conclusion"] not in (RED_CONCLUSIONS | GREEN_CONCLUSIONS)

Status contexts route exactly as before under it — SUCCESS green, ERROR/FAILURE red, PENDING/EXPECTED never COMPLETED — so only the unrecognized case moves.

I'm pushing that to this branch, along with a test for the description's claim that SUCCESS, NEUTRAL and SKIPPED stay non-blocking (nothing covered NEUTRAL or SKIPPED), and a widening of "cancelled before concluding" to "settled without a result" now that the bucket holds more than cancellations.

Nothing else in the change needs one: supersession, the red set, and the approval policy of approving over a check that never ran all read correctly, and the four new tests fail on main.

[tend-agent]

Two statements of the premise this change removes survive elsewhere in the files it touches, both outside the diff hunks.

references/approving.md — the After the approval bullet beginning A check was cancelled still says "The replacement run will cover the cancelled checks." Under the new reducer that is false for exactly the checks the poll now surfaces: a cancellation with a rerun at the same SHA is superseded in reduce_rollup and never reaches unverified (which test_cancelled_replaced_at_the_same_sha_is_green pins), so a cancelled check that makes the poll exit 2 is one nothing replaced. The bullet tells that session to do nothing, on grounds the Before the APPROVE bullet twenty lines above now contradicts — and it is the only instruction the post-approval poll's reader has for this outcome. The do-not-rerun rule in it still holds and should stay; what has to go is the coverage claim, replaced by naming the check as unverified.

test_terminal_non_success_conclusions_count_red's docstring — "left out of both buckets it would read as green" — now describes the opposite of what the file asserts two tests down, where test_a_conclusion_in_neither_set_is_not_green requires exit 2 for a conclusion in neither set. The reason STARTUP_FAILURE and ACTION_REQUIRED must stay in RED_CONCLUSIONS is now that otherwise they read as unverified rather than red — a different wrong verdict, not a green one.

Neither line falls inside a diff hunk, so no inline suggestion; I'm pushing both to this branch.