fix(ci): preserve invariant citations on main pushes

[tianmind-studio]

What changed and why

Pass the main merge commit's full message/body into the shared deterministic manifest through its existing --pr-body-file contract. This preserves product-invariant citations after merge instead of replacing the correctly documented PR body with an empty temporary file. Add a workflow wiring regression assertion that keeps the main-push step connected to that description. Closes #9744.

Product invariants affected

none

How it was verified

• Confirmed failed main run 29360878812 rejected INV-CHAT-1 and INV-VOICE-1 after Fix PTT higher-model context and cache boundary #9734 merged even though both the PR body and merge commit a3e1b7401560d6ae2b671c62fcfa3873ddd05e43 contain those IDs.
• Reproduced locally with python3 .github/scripts/run_checks.py --lane ci --base HEAD~1: the unmodified main-push path exited 1 for the same two missing IDs.
• Replayed the exact Fix PTT higher-model context and cache boundary #9734 merge diff after writing git show -s --format=%B HEAD to the body file. All 14 selected CI manifest checks passed, including product-invariants naming both required IDs.
• python3 .github/scripts/test_run_checks.py (10 tests passed)
• actionlint -shellcheck= .github/workflows/repo-checks.yml
• black --check --line-length 120 --skip-string-normalization .github/scripts/test_run_checks.py
• ruff check --target-version py39 .github/scripts/test_run_checks.py
• Passed lifecycle-header, version-prefixed filename, backend workflow-contract, and path-normalized deployment secret-boundary checks.
• Native Windows full preflight currently false-fails at the deployment secret-boundary ratchet because main still compares backslash current paths with forward-slash Git paths. That unrelated defect is Deployment secret-boundary ratchet treats all bindings as new on Windows #9738 with fix fix(preflight): normalize deployment paths on Windows #9743; all checks before it and all remaining selected checks pass for this branch.

Tests

The new manifest contract test isolates the main-push workflow step and requires both creation and forwarding of /tmp/main-push-body.md. The exact previously failing merge was also exercised through the production CI-lane runner. The no-body baseline still fails, confirming undocumented direct pushes remain fail-closed.

Root cause and durable guard (bug fixes)

Pull-request runs use scripts/pr-preflight to load PR metadata, while main pushes called run_checks.py directly without a body file. The runner intentionally substitutes an empty body when none is supplied, so the post-merge product-invariant check could never recognize valid citations. GitHub's regular merge commit already retains the PR description; forwarding that deterministic local data restores parity without API calls or weaker validation, and the workflow contract test prevents the input from being dropped again.

[tianmind-studio]

Fresh main-push evidence: Repo Checks run https://github.com/BasedHardware/omi/actions/runs/29365288514 failed exactly at product-invariants after merge 4399e927f -> 306f22378b. The workflow selected INV-AUTH-1 from the changed files, but run_checks.py received no PR body on the push event and reported the citation missing. This is the failure mode this PR prevents by preserving the merged PR body for the main-push check.

[Git-on-my-level]

Thanks for the focused CI fix. I reviewed the workflow-sensitive part of this PR and this looks like the right direction: the main-push path now passes the merge commit message/body through the existing --pr-body-file data path, and the new regression assertions cover both the workflow wiring and the backend workflow contract.

I do not see an obvious command-injection issue here: the commit body is redirected into a file and consumed as checker input rather than interpolated into shell. CI is also green on the current head.

Because this changes main-branch CI behavior, I’m leaving this as a positive maintainer signal rather than a formal approval. A human maintainer should still confirm that using the merge commit body is the intended source of invariant citations for all merge modes, and that direct main pushes without documented invariant citations continue to fail closed as expected.

---

by AI on behalf of David — if you need David’s attention urgently, please @Git-on-my-level and escalate with need human response.