#32477 app FFI re-pin: verify before pushing, commit through the contents API

Makes the app FFI re-pin land itself, through review, within about the release build time. #32305, #31927 and #32436 each left feat-cmux-next red on "Check the app FFI pin" for about an hour on 2026-11-02, while the re-pin PR (#32121) waited for someone to review and land it.

A PR can't re-pin itself: cmux-app-ffi-<sha> releases publish only from a feat-cmux-next push (the ffi-release environment and the tag ruleset). So the fix is to shorten the wait after the push:

• The repin job runs check-app-ffi-pin.sh --verify-release before it pushes app-ffi-repin. The pinned checksum has to be the published one, and the FFI sources have to match the release's SOURCE_SHA tree. A base that has since gained newer FFI sources fails here and waits for the newer publish.
• The pin commit goes through GitHub's contents API, so it is authored by the release App and signed by GitHub. A force-pushed git commit can't be told apart from a push by anyone else with write access to the branch. The review reconciler now reviews app-ffi-repin on first sight, but only when it changes Package.swift alone in such commits. The lander then lands it on that receipt.
• The JSON body goes in a file (--input), because Package.swift's base64 (about 131 KB) is past Linux's 128 KiB limit for one argument.

No permission changes: the job already mints contents: write for this App.

Changelog

none

Observed / Not run

• python3 tests/test_app_ffi_release_workflow.py: 10 tests OK on the head. The new assertions fail on base (verify before push, a contents API PUT with --input, no git commit).
• Locally, the jq payload round-trips Package.swift's base64 exactly.
• Not run: the job itself. It runs only on a feat-cmux-next push that changes FFI sources; the next one exercises it.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Makes the app FFI re-pin land itself automatically within about the release build time, instead of leaving feat-cmux-next red on "Check the app FFI pin" for about an hour while waiting for a reviewer.

• The repin job runs check-app-ffi-pin.sh --verify-release before pushing, so the pinned checksum must be the published one and the FFI sources must match the release's SOURCE_SHA tree.
• The pin commit now goes through GitHub's contents API, so it's authored by the release App and signed by GitHub; the review reconciler and lander process it on first sight without manual review.
• The JSON payload is passed via a file (--input) because Package.swift's base64 exceeds Linux's 128 KiB argument limit.

Changelog

none