fix(ci): wake PRs that predate the CI floor so they can ever be judged

[catomean]

The bug

auto-merge-sweep.sh merges a PR only if it has at least one check. That rule is right and must stay. But GitHub never retroactively runs workflows, so any PR opened before this repo gained its CI floor (2026-08-05/08-07) has zero checks, can never gain any on its own, and parks forever.

The script already diagnosed this — and only warned:

"No checks reported yet" is transient for a PR opened seconds ago and PERMANENT for an old one... Report it; only a push, or a close/reopen, will ever produce checks.

Warning does not move them. solon had 5 such PRs from 2026-06-22/06-29.

Why it mattered more than it looked

These PRs report mergeStateStatus: CLEAN. That reads as "ready to merge"; it actually means "nothing ever objected". Waking all five replaced that guess with evidence:

PR	bump	verdict once actually checked
#37	@playwright/test 1.46→1.61	✅ green — merged
#39	lucide-react 0.441→1.22	❌ verify fails
#30	@noble/hashes 1.8→2.2	❌ verify + integration fail
#31	@noble/secp256k1 2.3→3.1	❌ verify + integration fail
#38	@types/node 20→26	✅ both green, now conflicting

4 of 5 "CLEAN" PRs were broken. @noble/secp256k1 v3 removes hmacSha256Sync, randomPrivateKey, sig.recovery, toCompactRawBytes and Signature.fromCompact — that is src/lib/bitcoin/message.ts, the governance signing path. Bulk-merging the CLEAN ones as "mechanical dependency updates" would have broken Solon's signature rail.

The fix

The sweep now pushes check-less branches via update-branch, firing pull_request: synchronize so real checks run. The next sweep judges them on evidence like any other PR.

This loosens nothing: a woken PR still has to go green to merge; a red one parks exactly where it already was. It only replaces no evidence with evidence.

• Capped at WAKE_MAX_PER_SWEEP (default 3) so a backlog doesn't stampede runners. Waking never touches the base, so the one-car-per-sweep rule doesn't apply.
• Conflicted branches can't be updated — left to the existing CONFLICTING report rather than burning a wake slot.
• Branches already current can't be woken either; those get an explicit "close/reopen it" line instead of silent retries every 10 minutes.
• Uses "wake" throughout to avoid colliding with the file's existing RE-ARM (post-merge workflow_dispatch) vocabulary.

Verification

• bash -n clean; shellcheck unavailable locally, CI runs the full verify.
• Mechanism proven live on this repo before the script change: deps: bump @playwright/test from 1.46.1 to 1.61.1 #37 went 0 checks → verify+integration → green → auto-merged by the existing sweep at 00:33Z.
• New variables (WAKE_MAX_PER_SWEEP, woken) are declared before the loop, per the set -u lesson documented at the base_red_jobs declaration.

Follow-up (not in this PR)

• #31/#30 need a real @noble v2→v3 migration of message.ts — a crypto API rewrite that needs a human call, not an automated bump.
• This script is duplicated across 5 repos and has drifted: orangecat differs from solon by 194 lines, petvity by 2, fleetcrown and dotfiles differ again. This fix reaches only solon.

🤖 Generated with Claude Code