Three forge-side fns + a typed error the c0re approve-handler
(run_merge_config_pr, a follow-up) orchestrates to land an operator-approved
config PR:
- pr_head_sha(repo, pr): git ls-remote refs/pull/<pr>/head — the handler's
primary drift gate (compare against the approved sha).
- ff_push_to_main(repo, sha): the merge — ls-remote main, strict-ancestor
pre-check (git merge-base --is-ancestor in the agent's applied repo where
the orchestration has fetched the sha), then a non-force push sha:main. Two
independent guards so a raced main surfaces as NotFastForward rather than
clobbering reviewed history.
- mark_pr_merged(repo, pr, sha): POST pulls/<pr>/merge Do=manually-merged
MergeCommitID=sha; best-effort HeadDrift detection on non-2xx via a PR-head
re-read (the handler's pre-merge re-read is the primary gate).
ForgeMergeError {HeadDrift, NotFastForward, Other} (hand-rolled Display/Error/
From<anyhow::Error>, no new dep) so the handler can match recoverable drift
(refresh + re-verify) vs hard-fail. Core token sourced internally.
Uncalled until the handler lands (pub lib API, no dead_code). clippy -D,
unit tests, and treefmt clean.
376de8f161