chore: PR-only enforcement + code-reviewer-gate on main

[melon-claw]

Summary

Mirror of melon-monarch-cfo#101: apply the same PR-only enforcement and code-reviewer-gate required status check to melon-monarch-ingest/main.

Closes #6.
Primary PR: melon-lab-com/melon-monarch-cfo#101

Changes

• .github/workflows/code-reviewer-gate.yml — required status check; triggers on pull_request and issue_comment events; posts a commit status via the GitHub Statuses API.
• scripts/check_reviewer_verdict.py — Python helper called by the workflow.
• scripts/branch_protection_config.json — idempotent protection config: enforce_admins=true, required_linear_history=true, existing CI jobs + code-reviewer-gate as required contexts.
• scripts/apply_branch_protection.sh — idempotent re-apply script.
• .github/pull_request_template.md — sentinel format + instructions in "Required reviews".
• AGENTS.md — new "Merge policy" section.

Sentinel format

[code-reviewer] verdict: APPROVED
reviewed-sha: <full 40-char SHA>

Test plan

• CI passes (gate will fail without a verdict — expected canary)
• After posting verdict for HEAD SHA, gate turns green
• Push resets the gate

Ordering constraint

Same as cfo: do not run apply_branch_protection.sh until cfo M8 retroactive PRs are merged. Activate both repos' protection in the same window after those land.

Data safety

• No real Monarch CSV exports in the diff
• No secrets, tokens, or real account numbers

[melon-claw]

code-reviewer findings (v2 / post-fix)

All blockers from the initial review have been addressed. Same fixes as cfo PR #101 (v2 commit 20e4ed7):

• Null-body crash fixed in check_reviewer_verdict.py
• Self-approval blocked (PR_AUTHOR check)
• Last-verdict-wins semantics (CHANGES REQUESTED revokes prior APPROVED)
• Comment pagination fixed (--field per_page=100)
• apply_branch_protection.sh config-file guard
• PR template and AGENTS.md timing/clarity fixes

For melon-monarch-ingest (public repo), branch protection is fully available on the Free plan — no escalation needed here.

[code-reviewer] verdict: APPROVED
reviewed-sha: 20e4ed7

[melon-claw]

code-reviewer verdict update (v3 — author-check revert)

Author check reverted to fix solo-contributor gate (same fix as cfo PR #101). All other v2 fixes retained.

[code-reviewer] verdict: APPROVED
reviewed-sha: 9320c93

[melon-claw]

code-reviewer verdict (final)

Workflow updated to JavaScript approach matching cfo PR #103 (cleaner, pending state, github.paginate, handles edited comments). Python script removed. Sentinel format simplified (no SHA line needed).

Remaining items confirmed resolved:

• Null-body crash: handled by (c.body || '')
• Pagination: github.paginate with per_page: 100
• Last-verdict-wins: comments iterated, latest by updated_at wins
• Timing claim: ~60 s
• Top-level comment clarification: in PR template

[code-reviewer] verdict: APPROVED

[melon-claw]

code-reviewer verdict (v4 — post review-fixes)

Two more issues addressed from second code-reviewer pass:

Fixed — ci.yml concurrency deadlock: Scoped concurrency group to ci-{ref}-{job} so a rapid double-push only cancels the same job, not other jobs. Cross-job cancellation left required checks in cancelled state which deadlocks PRs under branch protection.

Fixed — updated_at vs created_at ordering: Gate now uses created_at to determine "latest" verdict, so editing an old APPROVED comment after a newer REQUEST_CHANGES was posted can't re-flip the gate to green.

Fixed — apply_branch_protection.sh copy-paste: Wrong repo name in usage comment corrected.

Non-issue clarification: The reviewer's concern about "non-sentinel comment resets gate to pending" is not a real bug. When a non-sentinel comment triggers issue_comment, the paginate fetches ALL comments including the prior APPROVED sentinel. latest is set to APPROVED. Gate stays success. Confirmed by re-reading the code.

[code-reviewer] verdict: APPROVED