feat(source-control): post the CI evidence comment from the merge gate #11393

Parent

Refs #8651. Evidence-verification plan: Brief and acceptance criteria at #11364 (comment); Design and Plan comments are on #11364.

Depends on

• feat(source-control): add the pull-request evidence posting step #11391
• feat(pr-pipeline): run the project's app-control skill in pr-verify after the deterministic tests #8651 (S7, the pr-verify capture job; also gated on owner answers Q10 and Q11)

Outcome

The merge gate posts the evidence marker comment on every merge path after a PASS verdict and a capture artifact exist, before the merge is enqueued.

Demo: run the babysit merge test suite; the artifact and no-artifact cases pass.

Plan (phase S5c)

Satisfies: AC1, AC8
Size Small-Medium. Depends on: S5a (#11391), S7 (#8651). Plugin: source-control (plugins/source-control/scripts/source-control-babysit-merge).

• Identify every merge path first (merge-pr, enable-auto-merge) and post on each before merge; upsert the marker comment linking pr-capture-<pr>-<head> with its expiry.
• Sanity Check: the babysit merge test suite passes with a case "PASS verdict + capture artifact → one marker comment, enqueue after"; a case "no capture artifact → no comment, merge unaffected".

Design excerpt

• source-control: /source-control:pull-request evidence posts one marker comment (local
  gh --attach; CI from source-control-babysit-merge after PASS, before enqueue); create.md's
  Visual evidence updated; playwright demo-video's reference/posting.md moves here, demo-video
  calls it.

components:
  schemas:
    PostEvidence:            # C6, /source-control:pull-request evidence
      type: object
      required: [pr, head_sha]
      properties:
        pr: {type: integer}
        head_sha: {type: string}
        summary: {type: string}                             # text summary; no files uploaded (AC10)
        artifact_url: {type: [string, "null"]}              # CI: pr-capture-<pr>-<head> link
        retention_days: {type: [integer, "null"]}
        marker: {const: "<!-- evidence-verification -->"}

Decision D4: CI posting lives in source-control-babysit-merge because pr-verify jobs hold read tokens only.

Acceptance criteria

Brief criteria this slice satisfies:

• AC1: A PR whose diff changes something visible in the interface gets screenshots or video captured and judged against its acceptance criteria before merge.
• AC8: A passing PR carries one comment linking redacted evidence; account and usage lines never appear in uploaded captures.

Done when:

• Sanity Check passes: the babysit merge test suite passes with a case "PASS verdict + capture artifact → one marker comment, enqueue after"; a case "no capture artifact → no comment, merge unaffected".
• Both merge-pr and enable-auto-merge paths are enumerated in the PR body and covered by a test
• The plugin's version and CHANGELOG are bumped per the repository's release convention
• ci-status is green on the PR head

Held for owner decision

Dependencies only; no scope is carved out of this slice. It depends on S5a (#11391) and on S7 = #8651; it cannot be picked up until the capture job exists.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UJUn7KoThXoYQoxfvdCVi7