feat: implement issue #2013 — dev-lead `fix-reviews`: posts "Fixed" replies for changes that were never pushed, and edits tests to match its own code

Merged
DO
19d ago
+2175-40

Problem

dev-lead fix-reviews: posts "Fixed" replies for changes that were never pushed, and edits tests to match its own code

From #2013 (observed on petry-projects/.github#1220, three incidents):

  1. "Fixed" replies posted before a push that was then refused; the claim named the PR's first commit (a stale pre-pass head) and was never retracted.
  2. 15a919e was pushed with the existing suite red: it added a new test and broke an existing one without editing it. CodeRabbit then confirmed the reply as addressed, so a wrong fix cleared a review gate.
  3. 13927fc rewrote an existing test to match the code, applying a bot's "update the older test so the suite can pass" literally.

Fix (ADR-0011): verify what landed and retract claims that did not (claim-landing.sh, addressed-claim-verify.sh); refuse an unjustified existing-test rewrite (test-tamper-guard.sh); refuse a push when a test that passed on the pre-pass head fails on the result (test-regression-guard.sh). Applies to fix-reviews, fix-bot-comment, review-changes and human-pr.

Risk

Medium — changes GitHub Actions workflow behavior, which is exercised only post-merge; verify via the affected workflow runs.

Test plan

Tests added/updated: tests/dev-lead/unit/test_addressed_claim_verify.bats,tests/dev-lead/unit/test_claim_landing.bats tests/dev-lead/unit/test_fix_reviews.bats,tests/dev-lead/unit/test_test_tamper_guard.bats, tests/dev-lead/unit/test_test_regression_guard.bats. Verification: bash scripts/dev-lead-lint.sh (shellcheck --severity=warning) ran pre-commit; the bats suite runs in CI.

Rollback

Revert this PR. No non-revertible side effects (no tags, migrations, or external state).

Monitoring

Watch the affected workflow run(s) in the Actions tab and this PR's Lint check for regressions.

Closes #2013