[patcGM]

Fix

• extend GitHub read-only reconciliation to a 28-second provider convergence window
• preserve the invariant that an accepted cancellation request is never retried
• remain INDETERMINATE if the exact run still has not converged after the bounded window

Live evidence

The protected provider drill recorded REQUESTED once, polled the exact run, and failed closed after GitHub still reported in_progress at approximately six seconds. The provider reported the same run as cancelled moments later. npm revocation was correctly not attempted because later phases stop after an indeterminate action.

Verification

• default-window regression assertion
• 104 tests; 76% branch coverage
• Ruff, format, actionlint, Bandit, and pip-audit pass

A fresh disposable GitHub run and a new preview will be used after this change reaches main.