fix(fr-gate): attribute rebase-and-merge commits (blocker for #74)

[LukasWodka]

Blocker for #74 — fixes a fail-closed gate that would break rebase-and-merge repos

Bugbot flagged this on #74. GitHub rebase-and-merge replays a PR's commits unchanged — no (#N)
in the subject, no merge commit. So the gate-the-diff attribution sees neither a subject marker nor a
PR-merge to vouch from, dumps those commits into UNATTRIB, and hard-fails the gate. Once #74
arms fr-gate.yml from @main, every one of the 15 caller repos that uses rebase-and-merge would
have its next promotion blocked on legitimately-merged commits.

allow_rebase_merge is true on all repos, so this is reachable, not theoretical.

Fix

An authoritative fallback using GitHub's own record: for a commit the local git heuristics can't
place, repos/{repo}/commits/{sha}/pulls says which PR introduced it. A merged PR attributes it
(rebase, squash, or merge); a direct push has none and stays flagged — which is exactly the
defect the gate exists to catch.

• The fast local checks (subject (#N), merge-vouch M^1..M^2) stay as fast-paths, so the API is
  hit only for the residual — near-zero calls on a squash/merge-commit repo.
• Retries 3×; fails closed on a persistent API error (an unverifiable commit never passes).
• Adds GH_TOKEN (PROJECTS_KANBAN_TOKEN) + REPO to the items step.

Decision logic verified with a stubbed gh: merged-PR → attribute, direct-push → flag, API-error →
flag (fail-closed). actionlint clean.

Once this merges, #74 picks it up automatically (its head is develop).

---

Note

Medium Risk
Changes promotion-blocking attribution logic and depends on GitHub API availability; fail-closed behavior avoids silent bypass but could block promotions on API outages.

Overview
Fixes false FR gate failures when promotions include commits from rebase-and-merge PRs, which replay unchanged commits (no (#N) subject, no merge commit) and were incorrectly treated as unattributable direct pushes.

After the existing subject and merge-vouch checks, the Discover items step now calls repos/{repo}/commits/{sha}/pulls for any remaining bare commits. A commit linked to a merged PR is accepted; only commits with no merged PR stay in UNATTRIB. The step gets GH_TOKEN (PROJECTS_KANBAN_TOKEN) and REPO, retries the API 3×, and fails closed (flags the commit) if verification never succeeds.

^{Reviewed by Cursor Bugbot for commit 449fce1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 41 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• .github#64 — fix(closure-router): add GH_TOKEN to closing-PR lookup so issues mirror their closing PR's Status · author: @LukasWodka · no reviewer assigned
• .github#68 — feat(fr-gate): make the FR gate self-clearing and self-explanatory · author: @LukasWodka · no reviewer assigned
• .github#74 — promote: FR gate fail-closed (fix(fr-gate): fail closed on an unreadable or absent Status #71) to main · author: @LukasWodka · no reviewer assigned
• averaging-service#207 — Promote develop → staging · author: @shujaatTracebloc · no reviewer assigned
• backend#1201 — docs(rfc): Data spaces & federated dataset composition (draft) · author: @LukasWodka · no reviewer assigned
• backend#1217 — docs(rfc): Dataset integrity & score reproducibility (draft) · author: @LukasWodka · no reviewer assigned
• backend#1228 — Promote develop → staging · author: @shujaatTracebloc · reviewer: @saadqbal
• backend#1244 — fix(experiments): surface save-time failures as 5xx + guard new NOT NULL columns · author: @LukasWodka · reviewer: @saqlainsyed007
• backend#1251 — docs(bugbot): add .cursor/BUGBOT.md project context (#930) · author: @LukasWodka · no reviewer assigned
• backend#1254 — docs(pr-template): owner-qualify cross-repo closing keywords · author: @LukasWodka · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 449fce1. Configure here.}