[CI] Make OpenCode coverage artifact handoff attempt-scoped and rerun-safe

[seonghobae]

Incident

A failed-jobs-only rerun of central OpenCode review run 31022108085 for ContextualWisdomLab/pg-llm-batch#53 reproduced a deterministic recovery defect. The successful coverage-source-tree producer was not rerun, while coverage-evidence reran after the one-day opencode-coverage-source artifact had expired. actions/download-artifact therefore failed before any test or docstring evidence ran.

Root cause

The producer/consumer handoff is selected by one static artifact name and assumes the current run attempt contains a live artifact. GitHub permits rerunning only failed jobs, so a successful producer can be omitted from a later attempt. Short retention is intentionally privacy-preserving and must not be widened merely to hide this lifecycle mismatch.

Required bounded repair

• add a permanent RED contract before changing the workflow;
• give each upload an attempt-scoped name;
• export the immutable upload artifact-id from coverage-source-tree;
• download only that exact ID in coverage-evidence;
• preserve one-day retention, exact-head metadata validation, separate credentialed producer, and credential-free untrusted-test job;
• convert missing/expired/current-attempt-absent evidence into a bounded actionable failure that requires a full rerun or fresh repository dispatch, never stale-artifact fallback;
• document failed-jobs-only versus full-rerun behavior and rollback with current GitHub artifact/action references in APA 7th form;
• require exact-head full tests, 100% production statement/branch coverage, public docstrings, security/supply-chain checks, current-head review, independent approval, and protected merge.

Non-goals

Do not increase source-artifact retention, inject repository credentials into the untrusted coverage job, reuse an earlier attempt's artifact by mutable name, auto-approve, auto-merge, or weaken branch protection.