fix(ci): recover main quality gates and deterministic validation

.env.example

@@ -3680,6 +3680,8 @@ QUOTA_STORE_DRIVER=sqlite
 # then auto-generates a secret into a shared volume (CDP_PROXY_TOKEN_FILE) that the
 # app reads. Set it explicitly only to pin your own value (`openssl rand -hex 32`).
 # CDP_PROXY_TOKEN=
+# CDP_PROXY_TOKEN_FILE: shared token-file path; Compose sets this in both containers.
+# CDP_PROXY_TOKEN_FILE=/cdp-token/token
 # CHATGPT_WEB_CODEX_TUNNEL_ID=tunnel_0123456789abcdef0123456789abcdef
 # CHATGPT_WEB_CODEX_RUNTIME_KEY=
 # CHATGPT_WEB_CODEX_CONNECTOR_NAME=OmniRoute Codex v2

.github/workflows/api-route-typecheck.yml

@@ -5,31 +5,42 @@ on:
     branches:
       - main
       - "release/**"
-    types: [opened, synchronize, reopened, ready_for_review]
+    types: [opened, synchronize, reopened, ready_for_review, edited]
+  merge_group:
+    types: [checks_requested]
   push:
-    branches: [main]
+    branches: [main, "release/**"]
   workflow_dispatch:
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  # Metadata edits must not evict a pending candidate or cancel a running check.
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event.action == 'edited' && github.event.changes.base == null && github.run_id || 'candidate' }}
   cancel-in-progress: true
 
 permissions:
   contents: read
 
 jobs:
   api-typecheck:
-    name: API Route Typecheck
+    # A skipped job reports success. Reserve the required name for real candidates.
+    name: ${{ (github.event_name != 'pull_request' || github.event.action != 'edited' || github.event.changes.base != null) && 'API Route Typecheck' || 'Admission not requested / API Route Typecheck' }}
+    # Base retargets arrive as edited too; body/title edits are observation-only.
+    if: ${{ github.event_name != 'pull_request' || github.event.action != 'edited' || github.event.changes.base != null }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          ref: ${{ github.event_name == 'merge_group' && github.event.merge_group.head_sha || github.sha }}
           persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: "24"
-          cache: npm
+          # Release pushes validate a fresh install; existing event caches stay enabled.
+          package-manager-cache: false
+          cache: ${{ (github.event_name != 'push' || !startsWith(github.ref, 'refs/heads/release/')) && 'npm' || '' }}
       - uses: ./.github/actions/npm-ci-retry
+        with:
+          cache: ${{ github.event_name != 'push' || !startsWith(github.ref, 'refs/heads/release/') }}
       - name: Reject new API-route TypeScript diagnostics
         run: node scripts/check/check-api-typecheck.mjs
       - name: API typecheck gate unit tests

.github/workflows/base-ci-repair.yml

@@ -19,9 +19,11 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
+          persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
           node-version: "24"
+          package-manager-cache: false
       - name: Verify old failure and final guarded transport
         run: node scripts/check/base-ci-repair.mjs
       - name: Clean owned state

.github/workflows/build.yml

@@ -31,12 +31,12 @@ jobs:
           free -h
 
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: "24"
           cache: npm
@@ -65,7 +65,7 @@ jobs:
           tar -czf omniroute-build.tar.gz .build dist
 
       - name: Upload build artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: omniroute-build
           path: omniroute-build.tar.gz

.github/workflows/cancel-closed-pr-runs.yml

@@ -0,0 +1,43 @@
+name: Cancel runs of closed PRs
+
+# CI and Quality intentionally use `cancel-in-progress: false`: the running candidate
+# completes and GitHub retains only the newest pending candidate. Closing a PR creates no
+# successor, so this API-only job removes active work that can no longer merge. It checks
+# out only this script from the trusted default branch and never runs PR code.
+# `pull_request` (not `_target`): the job restricts its `actions: write` token to
+# same-repository heads; fork PRs are skipped and retain GitHub's normal restrictions.
+
+on:
+  pull_request:
+    types: [closed]
+
+permissions:
+  contents: read
+
+jobs:
+  cancel:
+    name: Cancel queued runs of this PR
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      actions: write
+      pull-requests: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          persist-credentials: false
+          sparse-checkout: scripts/ci/cancel-closed-pr-runs.mjs
+          sparse-checkout-cone-mode: false
+      - name: Cancel this PR's queued and running workflow runs
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          SELF_RUN_ID: ${{ github.run_id }}
+        run: node scripts/ci/cancel-closed-pr-runs.mjs