ci: admit the Claude reviews of one pull request one at a time - #963

CodeQL py/import-and-import-from (alert 258) on the file taken from Cortex;
the same change is in cdeust/Cortex#963.

Co-Authored-By: Claude Fable 5.2 <[email protected]>
Claude-Session: https://claude.ai/code/session_018kyZYsWnKSjpX4oNV19PCF
Signed-off-by: Claude <[email protected]>

…e merge (#244)

* ci: the default profile follows Cortex, the Claude verdict decides the merge

The template takes Cortex's resolve and close-issues jobs and its merge
aggregate, and loses its review job (review, repair, auto-merge arming). The
resolver merges a head whose Pipeline succeeded and whose latest Claude
verdict, bound to a review run of that head, approves (Cortex ADR-1121);
low-risk Dependabot updates need no review (ADR-1126); the review's
completion wakes the resolver (ADR-1127). claude-review.yml and its budget
script are Cortex's (ADR-1119). The native profile is unchanged.

pytest tests/: 3994 passed (3975 before). tools/ci_post_merge.py: 99 % lines.

Co-Authored-By: Claude Fable 5.2 <[email protected]>
Claude-Session: https://claude.ai/code/session_018kyZYsWnKSjpX4oNV19PCF
Signed-off-by: Claude <[email protected]>

* ci: keep the tracked .coverage file this change never meant to touch

Co-Authored-By: Claude Fable 5.2 <[email protected]>
Claude-Session: https://claude.ai/code/session_018kyZYsWnKSjpX4oNV19PCF
Signed-off-by: Claude <[email protected]>

* ci: the default render delivers the review its resolver waits for

A consumer rendered with the default profile received the resolver that
holds every merge without a Claude verdict, but not claude-review.yml, its
budget script, the /review-pr command or its reviewers (Codex P1 on #244).
templates/ci/review carries them and prepare_files delivers them.

pytest tests/: 3996 passed.

Co-Authored-By: Claude Fable 5.2 <[email protected]>
Claude-Session: https://claude.ai/code/session_018kyZYsWnKSjpX4oNV19PCF
Signed-off-by: Claude <[email protected]>

* ci: session-optimizer's uv-compiled requirements pair is a dependency file

Its Dependabot updates touch requirements-dev.in and requirements-dev.txt;
without them in LOW_RISK_FILES every such update waits for a review that
Dependabot runs never get.

Co-Authored-By: Claude Fable 5.2 <[email protected]>
Claude-Session: https://claude.ai/code/session_018kyZYsWnKSjpX4oNV19PCF
Signed-off-by: Claude <[email protected]>

* ci: the native caller wakes on the Pipeline only

The shared completion caller now listens to PR Review too, but the native
resolver accepts a Pipeline source only, so each native review completion
would have started a failing run (Codex P2 on #244). The renderer keeps the
review wake-up for the default profile alone.

Co-Authored-By: Claude Fable 5.2 <[email protected]>
Claude-Session: https://claude.ai/code/session_018kyZYsWnKSjpX4oNV19PCF
Signed-off-by: Claude <[email protected]>

* test: import unittest.mock one way in the budget test

CodeQL py/import-and-import-from (alert 258) on the file taken from Cortex;
the same change is in cdeust/Cortex#963.

Co-Authored-By: Claude Fable 5.2 <[email protected]>
Claude-Session: https://claude.ai/code/session_018kyZYsWnKSjpX4oNV19PCF
Signed-off-by: Claude <[email protected]>

* ci: admit the Claude reviews of one pull request one at a time

Cortex #963: a per-PR concurrency group on claude-review.yml, so
overlapping pushes cannot pass the three-review cap. Same file in
templates/ci/review, which the default render delivers.

Co-Authored-By: Claude Fable 5.2 <[email protected]>
Claude-Session: https://claude.ai/code/session_018kyZYsWnKSjpX4oNV19PCF
Signed-off-by: Claude <[email protected]>

---------

Signed-off-by: Claude <[email protected]>
Co-authored-by: Claude <[email protected]>