fix: repair incomplete CLA ledger records

[bestony]

Summary

• normalize trailing whitespace on recheck and ICLA signing comments while rejecting any other suffix before invoking the pinned action
• complete every ledger row missing full_name or public_email, including rows discovered by recheck and pull_request_target reruns
• read and verify the ledger at exact commit SHAs so an immediately stale branch read cannot fail a successfully persisted enrichment
• keep the base-evidence and complete-evidence checks fail closed, and continue executing only trusted base workflow code

This fixes the cross-PR failure observed in Actions run 30321284493. A recheck run had written two base records without running signer-specific enrichment; a later, unrelated PR check then failed the global ledger validator.

Validation

• pnpm check (passes with 16 existing warnings and 1 existing info diagnostic)
• pnpm typecheck
• pnpm test (server test setup is blocked locally because no container runtime is available; CI provides PostgreSQL)
• actionlint v1.7.12 with the existing targeted suppression for GitHub's supported concurrency.queue
• ShellCheck for both changed inline Bash scripts
• historical b4f0c07 ledger fixture: rejects the incomplete ledger, enriches both duplicate rows by stable user ID, then passes the complete schema
• malformed base-record fixture remains fail closed
• mocked Contents API write verifies the enriched payload and exact persisted commit
• current live ledger runs through the exact completion script as a no-op

Change Surface

• apps/cli public CLI or help output
• tree onboarding / binding / inspection behavior
• shipped or planned skill topology
• docs or contributor-facing repository metadata
• CI / packaging / release plumbing

Notes

• package or install behavior changes: none
• docs or tests updated to match: no durable contributor policy changed; validation is scoped to the workflow and the historical production ledger fixture
• follow-up work: after merge, retrigger PR fix(server): add app-wide browser security headers (#1541) #2026 with recheck to verify the provider path on the default-branch workflow

[yuezengwu]

实现目标：修复 CLA action 在 recheck / pull_request_target 路径只写入基础签名记录、未补全公开 profile 字段，导致后续任意 PR 被全局 ledger 校验阻塞的问题。

核心改动：

• 仅接受精确命令加尾随空白，其他前缀命中由 classifier 安全忽略；
• 对每次有效非 closed 触发扫描全部缺失字段的 signer ID，并按稳定 GitHub user ID 补全所有重复记录；
• 从 branch ref 解析精确 commit 读取 ledger，PUT 后再从返回的 commit SHA 回读并校验；
• 保留 base evidence / complete evidence 的 fail-closed 校验，并继续只执行 pinned action 与可信 base workflow code。

静态审查未发现 blocker。持久数据提示：该改动会补写 CLA JSON ledger 的 full_name/public_email，但不涉及应用数据库或核心业务数据结构变更。未运行测试（按 reviewer 配置仅检查 diff）；作者与 CI 的验证记录已在 PR 中。

[baixiaohang]

Recommendation: approve

• Rationale: The repair path now closes the cross-PR ledger failure without weakening command classification, signature evidence validation, or the trusted-workflow boundary.

Risk level: B-low

• Path baseline: .github/workflows/cla.yml is otherwise C.
• Semantic lift: the change modifies signing and CI merge-gate behavior, so it is lifted to B-low.

PR summary

• Author / repo: bestony / agent-team-foundation/first-tree
• Problem: A valid recheck could persist base ICLA rows without the promised public-profile fields, causing a later unrelated contributor's required CLA check to fail on the globally shared ledger.
• Approach: Accept exact signing commands with trailing whitespace, route all valid non-closed runs through one ledger-completion path, repair every incomplete row by stable GitHub user ID, and verify both reads and the persisted update at exact commit SHAs.
• Impacted modules: .github/workflows/cla.yml and the cla-signatures ledger workflow.

Review findings
✅ The classifier admits only an exact supported command plus trailing whitespace; arbitrary suffixes cannot invoke the pinned action or the write path.

✅ The completion step scans the whole ledger and updates every incomplete duplicate for a signer, covering records introduced by signing comments, recheck, and pull_request_target reruns.

✅ The write retains the blob-SHA precondition, and the post-write check reads the commit returned by the Contents API, so races fail closed while branch-ref staleness cannot reject a successfully persisted repair.

✅ Base evidence and complete evidence remain independently validated, and the workflow continues to execute only pinned action code plus trusted base-workflow shell.

⚠️ The end-to-end provider path still requires the documented post-merge recheck because pull_request_target executes the default-branch workflow; this is an expected verification step, not a blocker.

Action taken

• Approved head da80dd2b19ef2426a91117bc40f8173f74153694.
• Reviewed the diff, the pinned action control flow, and the historical failure logs only; did not run checks or tests.