fix(claude-automerge): catch oauth2/* and main.go in risk-tier globs

[topcoder1]

Summary

The risk-tier path glob list in claude-author-automerge.yml was missing two categories that exist in the policy's intent but not in the regex:

1. oauth2/ as a path segment — the (auth|login|session|oauth|sso) alternation required the literal segment oauth. The Go convention is oauth2/ (e.g., golang.org/x/oauth2), and oauth2 is oauth followed by 2, not oauth followed by / or end-of-string, so the anchor (/|$) rejects it.
2. Go service entrypoints (main.go at any depth) — no pattern covered these at all.

Observed gap (2026-05-24, on whois-api-llc/wxa-mcp-server)

PR	Files touched	Expected	Actual	Pattern that should match
#193	internal/oauth2/server.go, main.go	block	auto-enabled by app/github-actions	(^|/)main\.go$, ^(.*/)?(...|oauth2|...)(/|$)
#194	internal/auth/security.go	block	correctly blocked	^(.*/)?(auth|...)(/|$) ✓ already worked
#197	internal/oauth2/server.go	block	auto-enabled by app/github-actions	^(.*/)?(...|oauth2|...)(/|$)

PR #194 blocking correctly is the proof the auth alternation works as designed — only the missing oauth2 and main.go paths leaked through.

New glob list (additions only)

- ^(.*/)?(auth|login|session|oauth|sso)(/|$)
+ ^(.*/)?(auth|login|session|oauth|oauth2|sso)(/|$)
  ^(.*/)?secrets(/|$)
  ...
  ^(.*/)?(billing|payment[s]?|pricing|invoice[s]?)(/|$)
+ (^|/)main\.go$
  (^|/)Dockerfile(\..*)?$
  ...

Test coverage

selftest/test_automerge_risk_patterns.sh updated in lock-step. Six new RISKY cases and five new SAFE cases:

• RISKY: internal/auth/security.go, internal/oauth2/server.go, internal/oauth2/handler.go, pkg/oauth2/token.go, main.go, cmd/server/main.go, cmd/wxa-mcp-server/main.go
• SAFE (must NOT match): main_test.go, internal/foo/main_test.go, internal/oauth2.md (doc with substring), cmd/server/mainview.go (starts with main but not literal main.go), src/oauth2helper.go (oauth2 substring, not a path segment)

All 41 RISKY + 16 SAFE cases pass locally:

$ bash selftest/test_automerge_risk_patterns.sh
...
OK: all risk-pattern cases pass.

Smoke test plan (post-merge)

After this PR lands, callers reference @main so the new globs go fleet-wide immediately. Smoke test:

1. Open a trivial Claude-authored PR on whois-api-llc/wxa-mcp-server touching only internal/oauth2/ (e.g., add a doc comment).
2. Confirm claude-author-automerge declines with the sticky risk-tier comment instead of enabling auto-merge.
3. Close or squash the test PR.

Auto-merge rationale

In the manual-merge category — touches .github/workflows/**. The risk-tier path-scan will correctly block this PR on the new patterns; manual click-merge required. (Also, per CLAUDE.md, topcoder1/ci-workflows itself doesn't install the caller — filename collision with the reusable definition — so PRs to this repo always require manual merge regardless.)

Codex pre-review

Skipped: diff is purely additive regex + test cases (~30 LOC), and the regression surface is covered by the selftest, not by Codex.

Test plan

• bash selftest/test_automerge_risk_patterns.sh passes locally (41 RISKY + 16 SAFE)
• Post-merge: smoke-test on whois-api-llc/wxa-mcp-server per plan above

🤖 Generated with Claude Code

[github-actions]

Risk class: blocked — manual merge required.

This PR touches one of the blocked path categories from .github/risk-paths.yml (Dockerfiles, docker-compose, .github/workflows/**, **/.env*, **/secrets*, infra/, terraform/, k8s/, or the classifier config itself).

Auto-merge is refused by claude-author-automerge.yml. A maintainer should review the diff and click "Squash and merge" themselves.

(This is a policy notice, not a code-quality failure. The classify job itself does not fail — required CI checks remain authoritative for "is the code green.")

[github-actions]

Coverage Floor — mode: enforce

metric	value
measured	100.0%
floor (current)	99.0%
target	100.0%
last bumped	2026-05-12

[claude]

No issues found. Regex anchoring is correct for both new patterns — oauth2 segment boundary and main.go literal match — and the SAFE test cases cover the relevant false-positive boundaries.