chore(ci): remove orphaned OpenCode dispatch bootstrap on current main

.github/workflows/opencode-review-dispatch.yml

@@ -24,12 +24,6 @@ permissions:
   contents: read
 
 jobs:
-  required-workflow-bootstrap:
-    name: required-workflow-bootstrap
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo "OpenCode repository-dispatch review run materialized."
-
   validate-pr-metadata:
     name: validate-pr-metadata
     if: github.event_name == 'repository_dispatch'

tests/test_opencode_agent_contract.py

@@ -469,12 +469,12 @@ def test_opencode_ignores_superseded_cancelled_rollup_checks():
 def test_opencode_target_coverage_materializes_only_after_authorized_dispatch():
     """Keep PR-controlled test execution off the pull_request_target path."""
     workflow = Path(".github/workflows/opencode-review-dispatch.yml").read_text(encoding="utf-8")
-    assert "required-workflow-bootstrap:" in workflow
-    assert "OpenCode repository-dispatch review run materialized." in workflow
-    bootstrap_start = workflow.index("  required-workflow-bootstrap:\n")
-    bootstrap_end = workflow.index("\n  validate-pr-metadata:", bootstrap_start)
-    bootstrap_job = workflow[bootstrap_start:bootstrap_end]
-    assert "\n    if:" not in bootstrap_job
+    # required-workflow-bootstrap is the trusted-source-resolution sentinel needed
+    # only where the org ruleset targets a pull_request_target entrypoint
+    # (opencode-review.yml). This repository_dispatch-only workflow is not itself
+    # a required-workflow path, so it must not carry a copy-pasted, need-less
+    # orphan of that job.
+    assert "required-workflow-bootstrap:" not in workflow
     assert (
         "github.event.pull_request.head.repo.full_name == github.repository"
         not in workflow

tests/test_pr_review_autofix_nvidia_nim_contract.py

@@ -19,7 +19,7 @@
 DOCTORING_RECORD = Path("docs/doctoring/hourly-nvidia-nim-autofix.md")
 CHANGELOG = Path("CHANGELOG.md")
 REVIEW_DISPATCH_WORKFLOW = Path(".github/workflows/opencode-review-dispatch.yml")
-REVIEW_DISPATCH_BLOB_SHA = "cc0b84dff19195a7e209e9f78cd5ee80bfc58d53"
+REVIEW_DISPATCH_BLOB_SHA = "bb5d439c3fc2fc7b5fcd38533d38f96e1170cd2e"
 
 
 def _workflow_text(path: Path) -> str: