v3.15.1 — finalize_unit exit-code contract + pr_helpers pii-guard rc (patch)

Patch: developer-workflows 0.18.1

Two post-release bugfixes in finalize_unit.py and pr_helpers.py, found by adversarial /review on v3.15.0. No behavior change on the happy path (exit 0); callers that relied on exit 1/2 as a retry signal now get correct semantics.

Fixed

DEFECT 1 — finalize_unit.py: push-ok / PR-create-fail → exit 2 ("nothing pushed")
main() used result.action == "pr" as the exit-2 fall-through. When git push succeeded but gh pr create failed, the branch was already on the remote but main() returned exit 2 — callers retrying on exit 2 would push again (duplicate push).

DEFECT 2 — finalize_unit.py: push-rejected direct path → exit 1 ("graceful-skip")
When finalize_direct failed on a rejected push, action == "direct" → return 1. Nothing landed; callers silently missed the failure.

Fix: Replace the action-based heuristic with steps-based push detection:

push_landed = any(name == "push" and rc == 0 for name, rc in result.steps)
return 1 if push_landed else 2

• Exit 1 = push landed (branch on remote; PR creation failed or gh-unavailable fallback)
• Exit 2 = nothing pushed (push rejected, PII blocked, commit failed — safe to retry)

Review finding — pr_helpers.py: pii-guard step always recorded rc=0
finalize_pr() / finalize_direct() both appended ("pii-guard", 0) before calling pii_guard(). A blocked guard incorrectly recorded a passing rc in result.steps. Fixed: capture the guard return value first, then append the correct rc.

Regression tests

5 new tests in TestFinalizeUnitMainExitCodes (scripts/test_finalize_unit.py). Two were RED before the exit-code fix; all 11 tests green after both fixes.

Files changed

• src/developer-workflows/scripts/finalize_unit.py + dist copies
• src/developer-workflows/scripts/pr_helpers.py + dist copies
• scripts/test_finalize_unit.py
• src/developer-workflows/group.yaml (0.18.0 → 0.18.1) + marketplace manifests

Commits: 339fb77, 488d6a7, c842858
CI: green Mac / Linux / Windows
Tracking: #27
Paired release: none (crickets-only patch; no agentm change)