fix(ci): advance action tags on push instead of pull_request_target - #366

Summary

Advance action tags still triggers on pull_request_target closed. GitHub blocks that event by default in public repositories from 2 December 2026, with brownouts on 9 and 16 November, 16:00 to 18:00 UTC (changelog). The workflow merged after the DEVOPS-1803 inventory, so the open migration PRs do not cover it. Without this change, tag advancement stops at the cutoff and during each brownout.

• The workflow runs on push to main, checks out github.sha, and declares no dangerous trigger.
• The script resolves the merged PR whose merge_commit_sha is the pushed head on main, reads it from pulls/{n}, and passes the existing logic the same pull_request shape. The major-release, binary action, file count, ancestry and lease checks are unchanged.
• A push that is not a PR merge logs a warning naming the manual remedy and exits green. Several matching PRs or malformed API data fail closed without moving a tag. The commit-to-PR lookup retries 3 times, 5 seconds apart.
• The failure comment takes the PR number from the job output, so it still lands on the merged PR.

Test plan

• make test-advance-action-tags: 14 tests. The 8 existing tests are unchanged. 6 new ones cover a push resolving a PR, the major-release label read from the API, a push with no PR (retried three times), PRs that only contain the commit or target another base, several matching PRs, and malformed API data.
• Mutation checks: dropping the base filter, the single-match check or the retry each fails a test.
• actionlint, shellcheck, make check-bats-jobs and zizmor on the changed workflow are clean. Repository-wide make lint still reports the existing dangerous-triggers finding on issue_comment in .github/workflows/claude.yml:4, which origin/main reproduces.
• Live proof: the first merge to main after this one runs the new trigger. Check that run for Advanced <tag> or the no-change message.

Refs DEVOPS-1803

https://claude.ai/code/session_017edg9i7XSWRkNCSfeYYZzw