Replay focused central improvements after #731 restores the baseline

[seonghobae]

Purpose

Drain stale central pull requests without losing validated product and governance work. PR #731 is the sole bootstrap prerequisite: it restores CodeQL action consistency, clears Strix dependency advisories, and repairs the stale-base-lock coverage classifier. Once #731 lands, replay each item below from the new main as a small, current-head PR with no dependency-lock or unrelated workflow history.

Ordered replay queue

1. fix(automation): run securely pinned review repair every hour #704 — hourly, immutable-source review-feedback repair. Preserve exact cadence, one-dispatch bound, job.workflow_sha source binding, and focused contracts.
2. fix(ci): bound anonymous review provider budget #722 — bound the aggregate anonymous reviewer budget while preserving keyed fallbacks.
3. fix(review): defer R coverage on any declared dependency, not only Suggests #721 — R coverage deferral for declared Depends/Imports/LinkingTo/Suggests, still requiring a successful same-head R CMD check.
4. fix(security): redact sandboxed CI evidence without secret-bearing history #711 — redact sandbox verification stdout/stderr/timeouts/log tails with fail-closed shared imports.
5. fix(scheduler): accept safe Unicode branch refs #696 — accept Git-valid Unicode refs while retaining control/separator/path traversal and ref-format rejections.
6. fix(security): eliminate clean-scan warning output #690 — warning-free clean security scans using current upstream CLI contracts.
7. fix(review): expose cross-repository dispatch failures #692 — visible exact-head review-tool failure receipts without granting approval.
8. fix(strix): include search authorization context #697 — bounded Strix authorization context for search UI changes.
9. fix(strix): supply sibling SQL migrations as PR-scope context #608 — sibling SQL migration context for scoped Strix analysis.
10. fix(security): Strix provider 장애를 fail-closed로 유지 #587 — preserve fail-closed Strix behavior when providers are unavailable.
11. ⚡ Bolt: [성능 개선] 파일 내용을 가져오는 과정의 병렬화 (N+1 API 병목 현상 완화) #684 — parallel Noema file-context collection only with deterministic ordering, bounded workers, failure equivalence, and measured latency improvement.
12. docs(profile): refresh buyer-facing product catalog #705 — buyer-facing organization profile refresh.
13. feat(automation): run naruon commercial readiness hourly #709 — Naruon hourly commercial-readiness loop, rebuilt as the smallest source-pinned workflow set and retaining product-code tests plus CHANGELOG.md requirements.
14. fix(strix): retry artifact-less provider crashes without weakening exhaustion #734 — retry artifact-less Strix provider crashes through a bounded fallback chain while preserving fail-closed exhaustion and every real finding artifact.
15. fix(ci): snapshot dependencies on default-branch pushes so dependency-review has a base #736 — submit dependency snapshots on protected-branch pushes with commit-specific concurrency so dependency-review has a valid base graph.
16. docs(agents): record code-owner gate hold for solo maintenance #740 — record the solo-maintainer CODEOWNERS hold only in the organization-central agent policy, preserving all other approval and required-check rules.
17. build(deps): bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml from 3a7550f43ba5b58905a821ce3a0ed24c4858b3f4 to 9fd1bcce27f67e3bd819a0a7620e332803dc43bc #595 — advance the pinned OSV reusable workflow to the upstream hardening/GOTOOLCHAIN revision after revalidating its immutable nested-action contract.
18. build(deps): bump huggingface-hub from 1.20.0 to 1.23.0 #551 — refresh the Strix lock to a compatible current huggingface-hub/Click closure only after regenerating from post-fix(ci): restore central review, security, snapshots, and hourly repair #731 requirements and rerunning Python security checks.
19. fix(deps): protobuf를 aiplatform 호환 범위로 유지 #549 — retain the protobuf<7 Dependabot exclusion while google-cloud-aiplatform requires that compatibility range; implement from a clean branch rather than the long-lived Dependabot history.

Acceptance contract for every replay

• branch from post-fix(ci): restore central review, security, snapshots, and hourly repair #731 main;
• one coherent concern per PR;
• exact-current-head required checks and independent App review;
• 100% statement and docstring coverage for changed central Python code;
• immutable action/source pins and least-privilege permissions;
• no copied leaf-repository policy when organization-central policy is authoritative;
• no manual success status, bypassed review, or weakened security threshold.

Queue policy

Close the superseded long-lived PRs after linking them here. Their branches remain available as implementation references, but their stale check/review histories are not merge evidence. Keep only #731 as the active central bootstrap PR; clean successors such as draft #743 may remain staged without competing for merge readiness.