feat(automation): run Inkspan hourly NVIDIA NIM review repair

[seonghobae]

Purpose

Add the product-specific one-hour PR review → repair → revalidation caller for ContextualWisdomLab/inkspan while reusing the bounded NVIDIA NIM scheduler from prerequisite PR #782.

Product and MSA behavior

• run at minute 37 of every hour, offset from the Clearfolio heartbeat;
• target exact repository ContextualWisdomLab/inkspan and protected base main;
• permit at most one repair dispatch per invocation and one retry per exact head per hour;
• keep an Inkspan-specific single-flight concurrency group so product runs cannot cancel Clearfolio runs;
• call the product-neutral central scheduler rather than copying privileged implementation into Inkspan;
• preserve standalone Inkspan operation and naruon compose / ui.panel modular integration.

Credential and safety boundary

The caller passes only PR_REVIEW_MERGE_TOKEN and OPENCODE_APPROVE_TOKEN. It does not use secrets: inherit, COPILOT_GITHUB_TOKEN, GitHub Models, or direct NVIDIA_NIM_API_KEY binding. NVIDIA authentication remains confined to the two model-execution steps in the separately reviewed repair workflow. Workflow scope is read-only; Actions and Issues write permissions are job-scoped.

The repair plane cannot approve or merge a PR, publish a release, alter reviewer credentials, update branch protection, or convert a failed check into success.

Verification

The existing permanent hourly contract now validates both product callers, exact repository and base values, distinct concurrency groups, one-dispatch and one-hour retry bounds, job-scoped permissions, exact secret mapping, absence of prohibited credentials, and focused-workflow trigger coverage. The new doctoring record provides APA 7th primary-source references and rollback boundaries. CHANGELOG.md records the product heartbeat.

Stacked activation boundary

This PR intentionally targets fix/hourly-nvidia-nim-review-repair-main, the head branch of prerequisite PR #782, so the diff contains only the Inkspan caller slice. It must not merge before #782. After #782 merges, retarget this PR to protected main, rerun every exact-head contract, security, supply-chain, CodeRabbit, OpenCode, Noema, independent-approval, unresolved-thread, and branch-protection gate, then enable normal auto-merge without bypass.

The schedule is not active until both prerequisite and this caller are present on the protected default branch.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 19861a07-38e6-4e12-b4cb-ab8ce4f930ee

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}