Lopu: backfill CodeQL and coalesce all-branch work

[lopugit]

Summary

• recover transient GitHub API failures during repository-wide PR inventory with bounded retries
• backfill current CodeQL coverage for every open PR against its exact live head and merge snapshot
• require both CodeQL categories, skip completed or already-active scans, and bind dispatches to the current head SHA
• reuse the existing Lopu schedules with at most 2 backfills per pass, plus a manual backfill-codeql batch of at most 12
• centralize PR lifecycle, qualifying push, and hourly all-branch signals through one manager sentinel before they enter the durable AI fleet
• coalesce redundant pending all-branch snapshots while preserving every active worker; no in-flight job is cancelled
• use a blobless full-history checkout for exact ancestry without downloading historical blobs
• keep one public Lopu PR manager while retaining reusable internal workers

Consolidation

This PR now targets github-actions directly and contains exactly the owned commits from #415 plus the CodeQL/all-branch follow-up. #415 never recorded a merge, so consolidating here removes the inactive stack dependency and makes one self-contained activation PR without touching main.

Validation

• node .github/scripts/codeql-open-pr-backfill.mjs --self-test
• node .github/scripts/workflow-control-plane-contract.mjs --self-test
• node .github/scripts/build-all-branch.mjs --self-test
• resolver, rebase, promotion, and workflow YAML contracts
• live read-only inventory rehearsal: 78 open PRs inspected, missing current snapshots selected, 0 workflows dispatched
• Graphify structural + Codex semantic refresh and cluster/export: 584 nodes, 1253 edges

Queue migration note

Existing pending runs were deliberately not cancelled and will drain under the old durable queue rules. Once this PR activates on github-actions, new all-branch event bursts are coalesced before expensive Lopu execution.

[github-actions]

Lopu repository review

Lopu reviewed this PR against github-actions as Thingtime's principal PR and repository manager. Backend: Claude Code default.

Lopu found no justified local change to publish from this review pass.

The model did not leave a detailed report; inspect this workflow run for the Lopu session log.

View Lopu workflow run