#21692 gh-merge-green: never waive a red risk evidence check

gh-merge-green now refuses a pull request whose exact head has a red or pending risk evidence check, even with --override. That check comes from the risk tiers in manaflow-ai/cmux#21691 (feat-cmux-next): it stays red until the description has the evidence the pull request's path-based tier needs. It reads only the description, so it is never base-red, and --override (meant for base-red and flaky lanes) must not wave it through. A maintainer waives it with the risk:waived label instead.

The change adds ^risk evidence$ to the same never-waived list as the god-file, l10n and concurrency lint, and names it in the refusal message. A cancelled check still refuses, as before. #21691 makes sure no skipped copy of the check is ever emitted.

Merge this first or together with #21691. Before #21691 merges no pull request reports risk evidence, so this changes nothing on its own.

Testing

• test_override_cannot_bypass_god_file_l10n_or_concurrency_lint now also covers risk evidence, completed red and still in progress.
  • Red at 1c7f3dc541c (test-only commit): both new subtests fail, because the helper merged.
  • Green at d278908e3e7.
• python3 -m unittest tests.test_gh_merge_green: 99 tests pass.

Review: SHIP with nits at d278908e3e7 (cmux-review subagent; the nit, a skipped run passing, is fixed on the workflow side in #21691)
Runtime test: python3 -m unittest tests.test_gh_merge_green at d278908e3e7

Changelog

none

Proof

Not UI: merge tooling only.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

gh-merge-green now treats a red or pending risk evidence check as never-waived, so --override can no longer bypass it. The check reads only the pull request description, so it is never base-red; a maintainer waives it with the risk:waived label instead.

This works with the risk tiers from manaflow-ai/cmux#21691. Merge this first or together with that PR — before it lands, no pull request reports risk evidence, so this changes nothing on its own.