Make no-run recovery populate the release PR check rollup

[forkwright]

Finding

The reusable release-PR healer cannot recover a required workflow once its fallback produces a completed workflow_dispatch run. It defines only action_required runs as approvable, but defines any run at the head SHA as satisfying workflow presence. A completed dispatch is therefore neither approvable nor eligible for another repair action, and its jobs do not populate the pull request’s statusCheckRollup.

Evidence

• At immutable source 8b8bef5c4b36a9e7e02c3e4d24723d83f745447f, held_run_ids() selects only action_required runs, while has_run_at() counts every run returned for the head SHA without filtering event or conclusion.
• heal() approves the first set and suppresses dispatch when the second set is non-empty. main() detects the still-empty rollup and fails, but no subsequent execution can change that state because the completed dispatch continues to satisfy has_run_at().
• GitHub’s current API data for Aletheia PR #6902 at head 80aee2126f4ec488bb90829078873cf715ebe487 contains successful workflow_dispatch runs 32525602889 and 32525606028. None of their 15 job IDs appears in the PR rollup. The corresponding pull_request runs 32525581711 and 32525581708 do appear there, including required jobs gate, cargo audit, and cargo deny.

Why this matters

A release PR that enters the no-run fallback remains blocked with an absent required context. Scheduled invocations repeatedly recognize the empty rollup but cannot create an approvable, PR-associated run. The fleet reusable therefore does not satisfy its stated guarantee for this state, and each caller inherits a release stall that automation cannot clear.

Desired correction

Make workflow presence mean a run that can populate the target PR’s rollup, and replace the dispatch fallback with a mechanism that creates the actual PR-associated required workflow run. Correct the workflow and script contract so no completed manual dispatch can suppress recovery. Do not synthesize or spoof the required context.

Done when:

• A regression fixture starts with no held PR run, one completed successful workflow_dispatch run, and an empty PR rollup; the healer does not classify that state as present or healed.
• An end-to-end probe starts with an open release PR missing a real required workflow context and proves that one healer cycle causes that workflow’s genuine context to appear in statusCheckRollup.
• A repeated cycle is idempotent after the real PR-associated context exists, and the caller contract advertises only the states the executable probe proves.