chore(ci): CTC-1231 — Mergify merge_protections, queue entry becomes platform-enforced

[ryanrozich]

Summary

Adds merge_protections rules to .mergify.yml, extending the catalyst-cloud config-as-code adoption (Mergify feature-suite evaluation, "Merge Protections rules — ADOPT NOW") to this repo: two checks that hold even for a PR merged by hand, outside the Mergify queue.

1. No unresolved review threads before merge — #review-threads-unresolved=0, active on every non-draft PR against main.
2. Title follows the Conventional-Commit convention — type(scope): ..., active on every non-draft PR against main except automation: dependabot[bot], Mergify's own queue-train/dashboard-config branches (head~=^mergify/), and release-please (head~=^release-please-- — it opens PRs under a human GitHub identity in this repo, not a bot login, so it can't be author-exempted).

This does not touch queue_rules/pull_request_rules. The auto-queue rule CTC-1231 also asks for (label=queue:ready + #review-threads-unresolved=0 + the required-check set → queue) already shipped today via CTL-2266 (#4079) — re-checked, unchanged, still correct.

Not required yet. A failing active merge_protections rule surfaces as a non-required Mergify Merge Protections check — this PR does not mark it required in the main branch protection ruleset, so nothing is newly blocking. That flip is Ryan's call, same restraint #4079 took with branch protection.

Note on .mergify.yml's own path exclusion: this repo's queue_conditions/merge_conditions already hard-exclude -files~=^\.mergify\.yml$, so this PR (and any future .mergify.yml change) can never enter the queue regardless of labeling — hand-merge only, by design, already in place before this PR.

Explicitly not in this PR (per the sibling catalyst-cloud evaluation and the dispatch instructions): CI Insights auto-retry, any Test Insights config.

Validation

mergify config validate

$ mergify config validate -f .mergify.yml
Fetching schema from https://docs.mergify.com…
Configuration file '.mergify.yml' is valid.

mergify config simulate — scope limitation, documented

mergify config simulate <PR_URL> only previews pull_request_rules/queue_rules evaluation. Ran it against #4066 (real Dependabot PR) to confirm the pre-existing queue rule is unaffected by this diff — it evaluated correctly (all conditions still resolve as before). It never surfaced the new merge_protections rules on any PR — that's a CLI/product scope limit (I found no documented way to preview merge_protections outside the dashboard), not a config defect.

In place of simulate for the new rules, I verified both directly:

• Review-threads condition — the exact same #review-threads-unresolved=0 attribute the existing queue_conditions already gates on; unchanged in this diff, and I didn't need to re-derive its correctness.
• Title regex — scripted the exact YAML-parsed pattern against real titles pulled from gh pr list history for this repo, both polarities:
  • Match: feat(meta): CTL-2266 — ..., perf(ci): CTC-1229 — ..., ci(runner-image): CTC-1228 — ..., chore(deps): Bump ... (Dependabot), ci: Bump actions/checkout from 4 to 7 (Dependabot, no scope), chore: release main (release-please).
  • No-match, correctly flagged: CTC-746: A ticket's agent session should still show its plan after th (a real, old, merged PR using a pre-convention title shape — historical, not currently open, so nothing bricks).

Local gate

No unified bun run check-equivalent here; ran mergify config validate (pass) and make lint/make test locally. make lint's trunk check currently fails on a pre-existing fmt/prettier formatting complaint about .mergify.yml — reproduced identically against the unmodified origin/main copy of the same file, so it predates this PR and isn't something this diff introduced or should fix (touching those pre-existing lines was explicitly avoided to keep the live, already-proven queue config untouched). make test surfaced one unrelated pre-existing failure (catalyst-config.test.sh, a config-fingerprint test with no relation to .mergify.yml) before my own timeout 180 truncated the (very large) suite; nothing in this diff touches that test or its dependencies.

Linear

CTC-1231 stays in Implement — dispatched with --phase implement; not moving it to In Review myself per the dispatch instructions (report only, don't merge).

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-28T23:09:28.688619Z	792c459	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 792c459d49

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".