fix(ci): isolate report queues and verify propagated Pages assets

[coisa]

Native report PR builds shared the production concurrency group, and shallow checkouts omitted history needed by PhpMetrics. The public identity verifier also retried only failed HTTP transfers, so stale successful CDN responses immediately failed checksums.

Use separate per-PR, production and feature-ref queues; retain serialization for main and cancel only obsolete runs of the same PR. Fetch the consumer's complete Git history. Retry the combined asset download-and-hash operation up to 12 times per asset, keeping transfer limits and failing on persistent mismatches. The legacy workflow and all permission boundaries remain unchanged.

Validation:

• 147 assertions against the actual Bash verifier and concurrency expression: stale HTTP200→correct bytes, transfer failure→correct bytes, independent logo/Dash retries, persistent mismatches exhaust 12 attempts with nonzero exit, and PR/ref groups cannot replace a pending production run.
• actionlint for both native workflow/wrapper, Bash syntax, diff check, changelog check.
• PHP library source/runtime is unchanged from the prior full gate (717 tests / 2,198 assertions / 91.83% coverage); no repeat suite was needed for these workflow-only changes.
• The first native implementation produced real feature builds and a successful main deployment for http-client. The follow-up will receive another actual caller run before rollout resumes.

Addresses the shared workflow findings on native consumer adoption PRs, including container#9, iterators#3, http-message#3 and defer#3. No Pages settings, branch protections, dependency allowlists or library source code are changed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-10T00:29:23.834641Z	1931f8a	PR opened
🔒 Security Review	✅ Completed 2026-10-10T00:31:09.812557Z	1931f8a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: c1a9f893-71b3-47e6-80b4-7b356476e488

---

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🚀 Preview is available for this pull request.

• Docs: https://php-fast-forward.github.io/dev-tools/previews/pr-364/
• Coverage: https://php-fast-forward.github.io/dev-tools/previews/pr-364/coverage/
• Metrics: https://php-fast-forward.github.io/dev-tools/previews/pr-364/metrics/