ci: retire audited orphan conflict checks

[ScriptedAlchemy]

Eight Hauler checks on PRs #2441 and #2452 remained queued because both heads have merge conflicts and GitHub never started their ordinary PR CI. Add a temporary manual-only cleanup to retire exactly those audited check identities using the trusted workflow job token.

The job requires the default branch, exact unchanged PR heads and confirmed conflicts. It rechecks each check identity and queued status before cancelling, skips already-cancelled matches on retries, and rejects running or otherwise changed checks. Cleanup dispatch excludes workers; ordinary dispatch remains unchanged. No PR checkout or code runs with credentials.

Validation: actionlint, Node syntax check, and seven behavioral cases including changed heads, running checks, altered identities, partial completion and idempotent retries. Independent review passed.

Remove this temporary job after the cancellation receipt is verified. Action pins and recipe/image inputs are unchanged, preserving accepted queue ownership.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 11b77c0

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-29T02:39:36.896325Z	11b77c0	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[ScriptedAlchemy]

PASS+NOTES for exact head 11b77c068eba9e044d497ababb7ae328ff7ae88e.

I reviewed the single-file PR diff against the frozen cleanup revision. The job runs only on an explicit manual dispatch from the repository's master branch. It has scoped check-write and PR-read permission, checks out no PR code, verifies all eight fixed PR/check identities before any write, and rechecks each queued status before cancellation. A completed canceled marker is a no-op, so a partial run can resume. The normal worker job is excluded from the cleanup dispatch.

actionlint, git diff --check, and seven local mocked behavior cases passed. I did not dispatch the workflow or cancel checks. The GitHub GET/PATCH sequence cannot make the final status check atomic; a check advancing between those requests remains a concurrency limit.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 11b77c068e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Remove the PR-specific cleanup receipt

This commits a temporary workflow whose only behavior is mutating eight hard-coded check runs for PRs #2452 and #2441; once invoked—or once those PRs change—the input, job, and embedded identities become stale production configuration requiring another cleanup commit. Implement durable orphan-check retirement in the canonical Hauler authority, rather than retaining a manually dispatched PR-specific receipt in the maintained CI workflow.

AGENTS.md reference: AGENTS.md:L172-L177

Useful? React with 👍 / 👎.

[ScriptedAlchemy]

The durable admission/retirement fix is Cargo Hauler PR #340. It deliberately retains exact policy ownership; broadening a new Action version to mutate old-policy checks would weaken that boundary.

This manual-only job is a one-time migration for the eight already-created old-policy markers, guarded by exact identities and fresh conflict/status checks. It is not intended to remain maintained configuration. Cleanup run 36513640350 is dispatched; I will remove the input and job after verifying its cancellation receipt. No general compatibility authority or new credentials are introduced.