watchCI races against GitHub check suite registration after push

[NTCoding]

References

#267 — observed during complete-task pipeline run

Summary

complete-task reports all checks passed while CI is still running. watchCI calls the gh checks watch command immediately after push, but GitHub has not updated the PR head commit yet. The command sees the old commit's completed checks and exits immediately with false success. This is a known gh CLI limitation (cli/cli #7401).

Full Details

Root cause: the checks watch command queries commits(last:1) via GraphQL. After pushing, GitHub may still return the old commit. The watch loop sees counts.Pending==0 and exits.

Fix: before watching, poll the PR view JSON for headRefOid until the head SHA matches the local HEAD SHA, confirming GitHub processed the push.

Files:

• tools/dev-workflow/platform/infra/external-clients/gh-cli.ts (add SHA verification before watch)
• tools/dev-workflow/features/complete-task/domain/steps/submit-pull-request.ts (add getHeadSha dep)
• tools/dev-workflow/features/complete-task/commands/complete-task.ts (wire dep)

Acceptance Criteria

• watchCI verifies the PR head SHA matches pushed SHA before watching
• Retries with backoff if SHA does not match within timeout
• Tests cover: SHA match on first poll, SHA match after retries, timeout exhausted
• complete-task no longer reports false success when CI is pending