ci: dependabot stays hosted under failover; runbook matches shipped bounds

- All four failover selectors (three workers + the verdict job) and the
  paired env/cache expressions now exclude dependabot[bot]: under
  failover, dependency-supplied code keeps queueing for the hosted pool
  instead of executing on the persistent VM. A delayed Dependabot PR
  during an outage is an acceptable cost; dependency code on the
  privileged host is not.
- Runbook (both languages): records the shipped failover bounds
  (coverage 8, snapshots 12, sized for six instances) and documents
  that the verdict job follows the selector too — operators previously
  had no explanation for a verdict queued after all workers passed.
- Local static gate green: 32 passed, 0 failed (translation pairing
  519 pairs consistent).
This commit is contained in:
Chinesezjc
2026-07-27 15:36:11 +08:00
parent aedf7fbf34
commit caabf8f671
4 changed files with 17 additions and 13 deletions
@@ -2,5 +2,5 @@
# side as of the last confirmed-consistent state. Both languages carry equal authority;
# after editing either side, bring the other along and re-record with:
# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-07-26-ci-failover-runbook.md
2026-07-26-ci-failover-runbook.md: 0bce83e0f9c842fa3dd73ae9c0a3eefc0975cdae
2026-07-26-ci-failover-runbook.zh.md: 4bc6c67bab754ad3f0127557b0d5e04f7934c8a2
2026-07-26-ci-failover-runbook.md: ab1a727caa045d2074a9c577416f96f45efcd0aa
2026-07-26-ci-failover-runbook.zh.md: 5dfaca0c1c0f443307bea28bb6544385ebb68bb7