[COVAL-7325] Leave hand-reconciled weekly API parity PRs unchanged

[callumreid]

Summary

The weekly parity job runs peter-evans/create-pull-request on chore/weekly-api-parity. Whenever the refreshed report differs, the action rebuilds the branch from main and force-pushes, which discards reconciliation commits pushed onto the rolling PR by hand.

This ports the guard from the MCP server's identical workflow (coval-ai/mcp-server#55):

• Check the rolling branch for hand commits. It looks up the exact ref through git/matching-refs, so a prefix match does not count, then counts the commits in compare/main...chore/weekly-api-parity whose committer is not github-actions[bot].
• Comment instead of resetting a hand-reconciled PR. When hand commits are present, the run comments on the open rolling PR and skips create-pull-request.
• Permissions. The workflow gains pull-requests: read to list that PR.

One addition beyond the MCP version (second commit)

Rolling PRs are squash-merged, and this repo does not delete head branches on merge. A merged PR therefore leaves chore/weekly-api-parity holding non-bot commits that never become ancestors of main. The branch still points at the head of #131 today. Ported as-is, the guard would report hand commits on every later run. It would skip create-pull-request and find no open PR to comment on, so the job would stop producing parity PRs without any error.

The second commit treats hand commits as protective only while a rolling PR is open. Once the PR is merged or closed, the next run rebuilds the branch from main as before. A closed PR's commits stay reachable through its PR ref. That commit can be dropped on its own if the MCP behavior is preferred.

The header comment and the README "API Coverage Audit" section describe the new behavior.

Validation

• actionlint 1.7.12 on all workflows: clean. shellcheck -s bash on the extracted guard script: clean.
• Dry run of the step's run: script, extracted from the YAML, against coval-ai/cli with a real GITHUB_OUTPUT file:

Case	Result
Exact MCP port, live chore/weekly-api-parity (#131 merged)	hand_commits=true, which is the stall described above
With the open-PR check, same branch	hand_commits=false
chore/weekly (prefix of an existing ref)	hand_commits=false (exact-ref filter)
Nonexistent branch	hand_commits=false

• [COVAL-7144] Reconcile the CLI with the Oct 5 API catalog and release 0.9.0 #131 has already merged, so its open state was replayed through the guard's compare filter with explicit SHAs. Base d3edcba...head 89a66a6 counts 2 non-bot commits (9c0afca, 89a66a6), so the guard would have returned true and left that PR intact. Base...286e1be (the bot's own refresh commit) counts 0.
• Live positive control: the guard run against this PR's own branch, which is open and has two non-bot commits, returned hand_commits=true with the notice has 2 commit(s) not made by the bot; leaving it unchanged.

🤖 Generated with Claude Code