feat(fullsend): add CI triage agent and repair loop

[divyanshiGupta]

Summary

Add an autonomous Fullsend CI/E2E triage and repair loop for RHDH Plugins.

What changed

• Add trusted intake for completed CI workflow runs.
• Resolve the matching open PR and verify its current head SHA.
• Identify failed leaf jobs and affected workspaces.
• Upload and analyze Jest and Playwright failure evidence.
• Add a read-only ci-triage agent using the retro role.
• Classify failures as code, test, flaky, infrastructure, or unknown.
• Retry high-confidence flaky failures once.
• Reuse the existing Fullsend fix agent through a CI-specific repair harness.
• Restrict repairs to the affected workspace.
• Require targeted verification before committing.
• Add host-side checks for stale heads, unsafe paths, secrets, oversized diffs, and non-fast-forward pushes.
• Add deduplication markers, concurrency controls, repair limits, and needs-human escalation.
• Keep forks diagnosis-only and support fullsend-no-fix as a kill switch.
• Add observe/repair/off rollout controls.

Safety

The agents never push directly. All mutations are performed only after deterministic host-side validation confirms that:

• The PR is still open and unchanged.
• The repair is limited to one approved workspace.
• The diff is within configured limits.
• Secret scanning passes.
• Required verification succeeds.
• The push can be performed as a fast-forward update.

Rollout

The automation defaults to observe mode. Repairs can be enabled gradually with:
FULLSEND_CI_AUTOMATION=repair
FULLSEND_CI_AUTOFIX_WORKSPACES=boost,scorecard,ai-integrations
Set FULLSEND_CI_AUTOMATION=off to disable the loop immediately.

Testing

• CI context and trust-boundary tests
• Schema fixture validation
• Diff guard tests
• Post-script safety tests
• Workflow YAML and permission checks
• Bash syntax checks
  yarn test:ci-agent passes.

✔️ Checklist

• A changeset describing the change and affected packages. (more info)
• Added or Updated documentation
• Tests for new functionality and regression tests for bug fixes
• Screenshots attached (for UI changes)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
1.1% Duplication on New Code

See analysis details on SonarQube Cloud