#29715 ci: rerun defaults guard for trusted SHIP receipt comments

The defaults guard’s independent SHIP receipt is posted as a normal pull request comment by the review router. The existing rerun workflow only listens for pull_request_review, so the guard remains red even after a valid exact-head receipt is present.

This workflow lives on main, GitHub’s default branch, so issue_comment events actually load it. It accepts only comments on same-repository feat-cmux-next pull requests whose first line is Review (...): SHIP at <current 40-character head>, and whose author is an OWNER, MEMBER or COLLABORATOR. It then reruns the existing trusted defaults guard; the guard itself remains the authority for reviewer and default validation. Pull request review events keep their existing behavior.

Leo: “If you get blocked, unblock yourselves, find a way, fix the waiting, fix the root causes.” This removes the waiting caused by a valid review receipt being posted through the comment path.

Validation: workflow YAML parsed successfully; shell syntax for the new step passed; git diff --check passed. The workflow-only main checkout is sparse and does not contain the repository’s pre-push script. No trust lists, secrets, checkout sources or guard validation were changed.

Risk: issue-comment events can only start a rerun after same-repository, trusted-author, exact-head receipt checks. The rerun still uses the existing base-trusted guard and cannot make an invalid receipt pass.

Agent session: agent session
🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes the defaults guard staying red after a valid SHIP receipt, because the review router posts receipts as normal PR comments while the rerun workflow only listened for pull_request_review events. The workflow now also handles issue_comment events, rerunning the trusted defaults guard for exact-head receipts from OWNER, MEMBER, or COLLABORATOR authors on same-repository feat-cmux-next pull requests. Reruns skip while a guard run is in flight or not yet started; a later receipt or push can retry. Review events keep their existing behavior, and the guard remains the sole authority on reviewer and default validation.

Summary by CodeRabbit

• Chores
  • Eligible pull request reviews and comments can trigger a rerun of a completed check for the current commit.
  • Comment-triggered reruns require an eligible contributor and a receipt matching the pull request’s current commit.
  • Reruns are skipped when no matching check is found or the check is still running; lookup errors other than “not found” remain errors.