Protect PR triage scans from unrelated comment traffic

[armstrongsam25]

Problem and issue context

Standalone: Ordinary issue comments can replace pending PR-triage context scans and reviewed maintainer decisions because workflow-level concurrency runs before the job can reject unrelated input. Observed enabled Deep scans 37362155988 and 37362497544 were cancelled during repeated ordinary-issue comment traffic. This maintenance change makes the requested triage rules operational under that traffic.

Changes and acceptance scope

Move the unchanged repository-wide serialization group to the job. Only exact-main PR comment events containing the closure-command prefix enter that job; scheduled and manual context scans remain eligible. The permissive substring filter preserves the trusted parser's leading-whitespace grammar, while the pinned action independently validates syntax, immutable maintainer identity, current permission, unedited public evidence and exact head before every closure.

Contract mutations reject restoring workflow-level cancellation, removing either routing condition, changing serialization, expanding permissions, running candidate code or changing the reviewed action pin. Document that a cancelled pending decision requires fresh review and a new command: scans reconcile context only, and GitHub's default queue can still replace pending matching work. No claim of durable command delivery is made.

Verification

python -m pytest tests/test_pr_triage.py tests/test_ci_workflow.py tests/unit/test_production_deployment.py -q: 64 passed and 18 denial/mutation subtests on Python 3.11.

Ruff and git diff --check pass. No product executable lines change, so changed-product coverage is explicitly not applicable; all existing hosted qualification gates remain required. Live routing verification requires the qualified merge on main and is not claimed yet. The unchanged shared action already passed 115 deterministic tests at reviewed source 9c83bac26fe9c5d594388afb70b30ed9076c90f1.

Compatibility and policy

No runtime, API, schema, migration, consumer pin, dependency, package version, release or deployment change. The owning constitution's existing metadata-controller permission remains the boundary: built-in short-lived token, only issues/PR write, exact main, no checkout, secrets, candidate execution, workflow approval/rerun or merge/release authority. Missing links request context; closure still requires reviewed evidence and a maintainer decision. Generated with Codex and independently reviewed for parser and concurrency races.

[armstrongsam25]

Exact reviewed queue-routing candidate: bc69538480cec71d9833c3f8b8afc902f6f3358c.

Hosted qualification is incomplete at 2026-10-05T20:01:32.754202+00:00. GitHub reports an ongoing hosted-runner assignment incident, and required jobs include cancellations:

• Python audit, SBOM, and package smoke was cancelled; no passing result is claimed.
• test (ubuntu-latest, py3.11) was cancelled; no passing result is claimed.
• test (ubuntu-latest, py3.12) was cancelled; no passing result is claimed.
• test (ubuntu-latest, py3.13) was cancelled; no passing result is claimed.

Local routing/permission mutation checks and Ruff pass, but they do not replace the owning CI aggregate. This PR stays open: no gate waiver, administrative merge or blanket rerun is applied. Fresh complete qualification and post-merge main-only routing verification remain necessary. The already merged initial policies and 59 reviewed closures are separately verified; task issues, contributor branches and points remain unchanged.