Invalidate stale lifecycle status after linked issue metadata changes #480

Parent

#455

Change contract

Keep the required Issue Lifecycle result on every open pull-request head synchronized with the current linked-issue metadata, using only the trusted default-branch auditor and a narrowly scoped status writer.

Acceptance criteria

• Relevant issue metadata changes that emit supported GitHub Actions issue events (body, category/triage labels, assignee, open/closed state) trigger immediate trusted default-branch reconciliation.
• The run enumerates open pull requests, invokes the merged auditor for each PR, and maps auditor exit 0 / 1 / 2 to the exact Issue Lifecycle commit status success / failure / error; both non-zero outcomes are red.
• The exact Issue Lifecycle context has one writer: Run the lifecycle auditor as a read-only GitHub check #467 keeps the distinct, non-required Issue Lifecycle Audit check name, and no Actions job/check run emits the authoritative context.
• An unfiltered issue trigger handles emitted issue activity; scheduled and manual full reconciliation catch Projects V2 field and native relationship changes that do not emit a supported Actions event, and auditor errors fail closed instead of preserving stale green.
• Trusted pull_request_target events seed each opened, reopened, synchronized, edited, or ready-for-review PR head without checking out or executing PR-head code.
• One repository-wide cancel-in-progress concurrency group prevents an older reconciliation run from overwriting newer lifecycle results.
• The workflow never checks out or executes pull-request code and never accepts a policy implementation from a PR head.
• Status-write permission is limited to the reconciliation job; contents, issues, and pull requests remain read-only.
• A focused test proves an issue mutation can replace a prior green PR-head status with failure and restore it after metadata repair.
• A live canary on a non-production PR demonstrates green -> metadata violation -> red -> repair -> green before Enable the Issue Lifecycle required check after a green observation window #460 changes branch protection.

Blocked by

#467 must merge first so the trusted read-only auditor entrypoint exists on the default branch.

Out of scope

• Historical metadata reconciliation; that remains Reconcile existing GitHub issue metadata against the lifecycle contract #459.
• Adding the context to branch protection; that remains Enable the Issue Lifecycle required check after a green observation window #460.
• Changing lifecycle policy or issue publication semantics.
• Closing runtime or tracking issues without acceptance evidence.

Rollout / rollback

Roll out with one canary PR and one named controller. Roll back by disabling the status-reconciliation workflow; do not alter existing branch protection until the canary has passed.