ci: scope the Fix Regression Gate to code paths, read all three closing forms

[azimafroozeh]

What & why

Follow-up to #596. #594 is a workflow-only fix whose body closes issue 588 by keyword. The Fix Regression Gate turned it red. No test can exist for a workflow file, so the only way through was a maintainer applying the no-repro label by hand. The gate was asking for something that cannot exist.

This PR makes the gate look at which files changed before it asks for a test.

• Code paths. The gate lists the files the PR changes. If none is under crates/ or tools/ (Markdown files there do not count) and none is the root Cargo.toml or Cargo.lock, the PR passes. The gate leaves a notice on the checks page naming the issues it did not examine. Those four places hold every workspace crate, so they are the only places a test can witness a change. The self-test checks that every [workspace] member sits under one of them.
• Closing forms. The gate now reads all three forms GitHub closes on: #N, OWNER/NAME#N, and the issue URL. Only this repository's references count (--repo, passed by the workflow as GITHUB_REPOSITORY).
• Failure text. When the gate fails it says which files made it look, lists the four ways through, points at near misses in the diff (a test or case under a slightly wrong name or in the wrong place), and prints a case skeleton. The same text appears as an error annotation on the checks page.
• PR template. The "Fixes an accepted issue" line now says what a fix under the code paths must carry.

The rule for a fix in a crate is unchanged: an issue_N_*.gqt case or an issue_N test in the diff, or the no-repro label.

Backing issue / RFC

• Implements RFC 0045, docs/rfcs/0045-gq-logic-tests.md (User and operational behavior, "Fix-PR gate"). The body and a dated Decision-log entry are updated in this diff; the entry names the sentences it supersedes. No GitHub issue; ci: emit Windows checksum manifests with LF #594 is the trigger.

Checklist

• Change is focused (one gate: its script, one workflow line, its docs, one template line)
• Tests added/updated for behavior changes (--self-test covers the closing forms, the code-path list, the workspace-members pin, --repo validation, the near-miss hints, and the failure-message shape)
• Public docs updated if user-facing surface changed (docs/dev/ci.md, RFC 0045, .github/PULL_REQUEST_TEMPLATE.md)
• Reviewed against docs/dev/invariants.md: no Hard Invariant weakened, no deny-list item hit (a CI policy check; no Rust changed)

Local verification

• python3 scripts/check-fix-regression.py --self-test: self-test ok, from the repository root and from another directory
• Gate by hand, a body closing issue 588 by keyword, --repo ModernRelay/omnigraph:
  • over the ci: run the Rust workspace suite on pull requests #616 range (workflows, scripts, docs): passes with the notice, exit 0
  • over the fix(compiler): resolve each pattern variable to one column binding #608 range (crates/omnigraph-compiler): fails with the file list, the four ways through, the skeleton, and the error annotation, exit 1
• A body closing issue 613 by its full URL, over the fix(traversal): do not count a self-loop as an extra hop #614 range: ok: issue #613 has a matching regression addition
• --repo ModernRelay: refused; no --repo and no GITHUB_REPOSITORY: a warning, #N only
• The printed skeleton saved as a case: parsed and passed in the corpus harness, then deleted
• python3 scripts/check-docs.py: OK (124 files)
• python3 scripts/check-workflow-action-pins.py: OK
• bash scripts/check-agents-md.sh: OK
• The gate on this PR itself runs main's copy of the script (pull_request_target), so the new script first runs live on the next fix PR after merge

Notes for reviewers

• What passes without a test: a fix outside the code paths (workflow, script, document, deployment file). The notice on the checks page names the closed issues.
• What still needs a test or the label: a fix under crates/, tools/, or the root manifests. A PR that touches a crate for any reason and also carries a workflow fix is examined. That is the same whole-PR grain the label has.
• Accepted gaps. A code issue closed by keyword from a PR that stays outside the code paths passes unexamined; the notice makes it visible and review owns it, as for the closing forms the gate does not read (GH-N, bare fixes#N, autolinks, Markdown links, commit-message keywords, manual closes). .cargo/config.toml and rust-toolchain.toml are outside the code paths; the dependency axis is covered because Cargo.toml and Cargo.lock are inside. A PR against a non-default base is examined although GitHub closes nothing there.
• The skeleton in the failure text spells the corpus format by hand. A change to header keys or section names in crates/omnigraph-gqt updates it too; the docstring says so.
• Engine footprint: none. no-repro unchanged.
• test(gq): add the Kuzu-derived .gqt case corpus #617 also appends to the RFC 0045 Decision log; whichever lands second keeps both entries in merge order.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.