Harden pull request CI validation

[konard]

Summary

• replace contradictory always() && !cancelled() guards, plus the remaining dependent always() guard, with cancellation-propagating !cancelled() conditions
• validate pull requests against a fresh merge of the latest base branch and scan the checkout with secretlint
• add a cached, no-push Docker image build for pull requests; repositories without a Dockerfile skip it with an explicit notice
• add workflow-policy and fresh-merge script regression tests plus a changelog fragment

Reproduction

Before this change, the workflow-policy regression tests fail because .github/workflows/release.yml contains three always() && !cancelled() expressions, has no docker-build job, and lacks both the fresh-merge and secrets-scan steps. The fresh-merge script test also fails because the script does not exist.

The Docker gate is credential-free (push: false) so it works for fork pull requests. This template currently has no Dockerfile, so its own run reports a skip notice; generated repositories that add one execute the cached Buildx build.

Verification

• .venv/bin/python -m pytest -v --cov=src --cov-report=xml --cov-report=term (49 passed, 100% package coverage)
• .venv/bin/ruff check .
• .venv/bin/ruff format --check .
• .venv/bin/mypy src/ (passes with existing Python 3.9 support/deprecation warnings under local Python 3.14)
• .venv/bin/python scripts/check_file_size.py
• PyYAML parse of .github/workflows/release.yml
• bash -n scripts/simulate-fresh-merge.sh
• git diff --check

Fixes #35

[konard]

Working session summary

Implemented and finalized PR #39.

Key changes:

• Replaced contradictory cancellation guards with !cancelled().
• Added fresh base-branch merge validation.
• Added configured Secretlint scanning.
• Added a cached, no-push Docker PR build gate.
• Added regression tests and changelog entry.
• Merged the latest main.

Verification:

• 49 tests passed with 100% package coverage.
• Ruff, mypy, formatting, file-size, YAML, shell, and Secretlint checks passed.
• Fresh CI run 29960061867 passed on final SHA a512250.
• Working tree is clean.
• PR is mergeable and ready for review.

---

This summary was automatically extracted from the AI working session output.

[konard]

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

• Model: GPT-5.6 Sol
• Provider: OpenAI
• Public pricing estimate: $9.093418

📊 Context and tokens usage:

• 172.3K / 200K (86%) input tokens, 13.4K / 128K (10%) output tokens

Total: (172.3K + 6.8M cached) input tokens, 13.4K output tokens, $9.093418 cost

🤖 Models used:

• Tool: OpenAI Codex
• Requested: gpt-5.6-sol
• Thinking level: off (disabled)
• Model: GPT-5.6 Sol (gpt-5.6-sol)

📎 Log file uploaded as Gist (1895KB)

• View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.

[konard]

🎉 Auto-merged

This pull request has been automatically merged by hive-mind.

• All CI checks have passed

---

Auto-merged by hive-mind with --auto-merge flag