#23428 ci: run the feat-cmux-next defaults guard from main

The feat-cmux-next defaults guard has never run. GitHub takes a pull_request_target workflow from the default branch whatever the PR's base, and .github/workflows/cmux-next-defaults-guard.yml exists only on feat-cmux-next. GitHub has never registered it (GET actions/workflows/cmux-next-defaults-guard.yml returns 404). As a result, #23105 merged a new default, layout.mainPane = "agent-chats", with no call owner's approval.

This PR adds the same workflow to main. It still judges with feat-cmux-next's own guard: scripts/ci/defaults_guard.py and .github/defaults-call-owners.json are checked out at github.event.pull_request.base.sha, which is the feat-cmux-next commit, never main's. It reads the head only as data. The one difference from the feat copy is a header note explaining why the file lives here. #22974 (risk tier) and merge-freeze.yml use the same pattern.

Once this is on main, the review re-run cmux-next-defaults-guard-review.yml also works. It finds the guard's run by this file name, which has had no runs until now.

Changelog

none

Evidence

• Replay of #23105, using feat-cmux-next tip's guard on the merge base 7052345 and the head 48354b3, with #23105's reviews. Exit 1:

  DEFAULTS setting.layout.mainPane: (none) -> "agent-chats"
  ::error title=Default changes need a call::1 default(s) changed; needs an approving review on 48354b34a70c from lawrencecchen or austinywang
  

• Same gap in other workflows. These pull_request_target-only workflows exist only on feat-cmux-next and are unregistered:

  • risk-tier.yml (#22974 moves it)
  • namespace-autofix.yml
  • intent-familiar-review.yml

  backend.yml is registered only through its pull_request and push triggers.

• Lint: actionlint passes.

• Live proof: after this merges, I'll open a draft feat-cmux-next PR that changes one default. It should get a red defaults guard; then I'll close it.

Agent session: cosmic-gray

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes the feat-cmux-next defaults guard never running by adding the workflow to main, where GitHub resolves pull_request_target workflows. Without it, #23105 merged the new default layout.mainPane = "agent-chats" with no call owner's approval.

• The guard and owners file are checked out at the PR's base commit, so feat-cmux-next's own policy still applies; the head is only read as data.
• The review re-run workflow (cmux-next-defaults-guard-review.yml) now works too, as it finds the guard's run by this file name.
• The only difference from the feat-cmux-next copy is a header comment explaining why the file lives on main.

Summary by CodeRabbit

• New Features
  • Added automated validation for default configuration changes in pull requests targeting the designated branch.
  • Reports validation results directly on pull requests, including when relevant changes are merged or closed.