chore(ci): keep PR #827 repair workflow (still reopenable); fix exact-head-path-policy CI gate

CHANGELOG.md

@@ -5,6 +5,19 @@ this file. The format follows Keep a Changelog, and versioned releases follow
 Semantic Versioning where the repository publishes a release.
 
 ## [Unreleased]
+- Keep the PR #827 repair workflow
+  (`.github/workflows/repair-pr827-coderabbit-comments.yml`) and its driver
+  script (`scripts/ci/repair_pr827_coderabbit_comments.py`): a prior pass on
+  this same PR proposed removing them as dead code on the theory that
+  "GitHub never reuses PR numbers" makes `github.event.pull_request.number
+  == 827` permanently false. Devin Review correctly flagged that reasoning
+  as a red herring here — PR #827 is `closed`/`merged: false`/`locked:
+  false`, so it remains reopenable by anyone with write access (or its
+  author) and would keep its original number if reopened, and its exact
+  head branch (`fix/opencode-rust-coverage-runtime-boundary-main`) still
+  exists on the remote at the same SHA. The workflow and script are
+  restored unchanged; the synthetic-fixture test kept alive purely for the
+  100% coverage gate is restored with them.
 - Harden the review sidecar's per-account catalog cap against silent drift:
   `contextual_orchestrator_review_launcher.py`'s two
   `build_zdr_prioritized_catalog` call sites now source their

scripts/ci/test_strix_quick_gate.sh

@@ -522,7 +522,7 @@ assert_opencode_review_uses_codegraph_and_contextual_orchestrator() {
 	assert_file_not_contains "$workflow_file" "Wait for trusted OpenCode approval review" "opencode pull_request bridge was removed to avoid duplicate required-check resource use"
 	assert_file_not_contains "$workflow_file" "Trusted OpenCode requested changes for head" "opencode pull_request bridge no longer reconsumes stale trusted review state"
 	assert_file_not_contains "$workflow_file" "github.event.pull_request.number == 240" "opencode review workflow must not hard-code repository-specific PR bypasses"
-	if awk '/^  required-workflow-bootstrap:$/,/^[^ ]/' "$bootstrap_file" | grep -q '^[[:space:]]*if:'; then
+	if awk '/^  required-workflow-bootstrap:$/{p=1; print; next} p && /^  [A-Za-z0-9_-]+:/{exit} p' "$bootstrap_file" | grep '^[[:space:]]*if:' >/dev/null; then
 		record_failure "opencode required workflow bootstrap must not depend on required-workflow event payload fields"
 	fi
 	assert_file_contains "$workflow_file" 'github.event.client_payload.target_repository || github.repository' "opencode review scopes concurrency by target repository"
@@ -1501,7 +1501,7 @@ assert_opencode_review_posts_suggested_diffs_inline() {
 	assert_file_contains "$workflow_file" "publish_request_changes_from_control" "opencode review REQUEST_CHANGES path publishes findings from the control JSON"
 
 	if awk '/format_request_changes_body\(\)/,/build_request_changes_review_payload\(\)/ { print }' "$workflow_file" |
-		grep -Fq '```diff'; then
+		grep -F '```diff' >/dev/null; then
 		record_failure "opencode review PR-level REQUEST_CHANGES body must not contain fenced suggested diffs"
 	fi
 }