#32120 ci(hosted light rescue): re-read the run before the cancel; fall back to it when pull requests are unreadable

What

These are review follow-ups on the main wiring PR #32061 (router-review, gpt-6-astra high, SHIP with follow-ups) for the hosted light rescue merged in #32023.

1. [P1] The live-head check could refuse every candidate. The overflow watch's GITHUB_TOKEN has actions: write and contents: read, but no pull-requests scope. So the rescue's GET /pulls/{n} could return 403 and leave every stalled run alone. The rescue still prefers the PR read. On a 403 or 404 it now falls back to the run itself, read again right before the cancel. GitHub keeps a run's pull_requests[].head.sha at each PR's current head. Any other read error still leaves the run alone. This adds no workflow permission.
2. [P2] A concurrent re-run could be cancelled. Before the cancel, the rescue now reads the run again and requires attempt 1, still in flight, the same head SHA, and at its PR's head.

It also adds a unit test for GitHub.jobs() building its total_count stand-in (a follow-up from the #32023 review) and fixes the UNWIRED comment wording ("as below").

Performance

metric	before	after	delta	harness or run link
API reads per rescue	1 PR read + 1 jobs read	+ 1 run read	+1 per rescue (≤ 10 a pass)	tests

Validation

• python3 -m unittest tests.test_ci_hosted_light_rescue: 24 OK. New cases cover an attempt-2 run left alone, the 403 fallback (rescued at the head, left alone when the fresh run shows a newer head), and a 502 that leaves the run alone.
• python3 tests/test_ci_workflow_guards_are_wired.py: OK.

Observed / Not run

I ran the commands above. #32061 will re-pin to this PR's merge commit.

Changelog

none

Agent session: agent session

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes two review follow-ups in the hosted light rescue: the live-head check could refuse every stalled run, and a concurrent re-run could be cancelled. The rescue now re-reads the run right before cancelling and falls back to it when pull requests are unreadable.

• The overflow watch's GITHUB_TOKEN has no pull-requests scope, so the PR head read could 403 and leave every candidate alone. The rescue still prefers the PR read; on a 403 or 404 it falls back to the fresh run, which GitHub keeps at each PR's current head. Other read errors still leave the run alone.
• Before cancelling, the rescue now requires the fresh run to be attempt 1, still in flight, at the same head SHA, and at its PR's head, so a run re-run meanwhile is never cancelled.

Adds a unit test for GitHub.jobs()'s total_count stand-in and fixes the UNWIRED comment wording. Costs one extra API read per rescue (≤10 per pass).