ci: run checks on rollout stack bases

[altaywtf]

Summary

• Run Next CI when a pull request targets next or a next-rollout/** stack parent.
• Keep push CI limited to next; no job, permission, runner, or delivery behavior changes.

Reviewer Guide

• Highest-risk area: the pull-request branch filter.
• Start with .github/workflows/ci-next.yml, then the workflow contract test.

Visual Aids

• N/A — workflow-only change.

Validation

• pnpm test — 12/12 on 90959c0
• actionlint .github/workflows/ci-next.yml on 90959c0
• mise run verify on implementation commit 8e2550c
• Base 00c5e4e passed Next CI after the pnpm 12 alignment
• Codex-high Slopguard — clean, zero findings on 90959c0 against 00c5e4e
• Latest-head GitHub CI and automated reviews settling

Sanity Checks

• An upper pull request based on next-rollout/runtime-seam matches the new filter.
• Push CI still matches only next.

Benchmarks

• N/A — no performance-sensitive change.

Notes

• Stack layer 1 of the next rollout.
• Delivery state: HOLD_UNMERGED; do not merge or enable auto-merge.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-29T12:15:27.857678Z	90959c0	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟢 Approval recommended

The workflow change is minimal, matches the stated intent, and is validated by an explicit contract test that prevents accidental broadening of push CI.

Pull request overview

This PR updates the “Next CI” GitHub Actions workflow so pull requests targeting rollout stack base branches under next-rollout/** also trigger the Next CI checks, while keeping push-triggered CI restricted to next. It fits into the repo’s workflow-contract approach by pairing the workflow change with an explicit contract test update.

Changes:

• Expand pull_request.branches in ci-next.yml to include next-rollout/**.
• Add a workflow contract test asserting PR base filtering includes rollout branches while push.branches remains ["next"].

File summaries

File	Description
.github/workflows/ci-next.yml	Adds next-rollout/** to the pull request base branch filter without changing push triggers.
scripts/legacy-delivery-workflows.test.ts	Updates/renames the Next CI contract test to validate the new PR base branch filter and confirm push remains limited to next.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.