fix(scheduler): fail after summarized action errors - #899

Summary

• return a non-zero scheduler process result only after the full bounded PR scan and structured summary when any decision is action_error
• preserve successful exit semantics for ordinary policy waits, blocks, skips, and deferred capacity
• make the organization sweep distinguish a pre-summary repository access denial from a summarized per-PR mutation failure, so both targeted and sweep paths expose the same terminal truth
• document the policy and add workflow/CLI regression contracts

RCA and feasibility

The symptom was a green workflow containing an action_error. The immediate cause was main() unconditionally returning 0; the root cause was that per-PR isolation and process-level execution truth were conflated. The sweep had a second classification boundary: it matched generic 403 text even inside a valid structured action-error payload.

The smallest feasible repair is to compute the exit result from completed decisions after print_summary() and use the existing versioned payload as proof that a sweep failure occurred after repository materialization. Raising immediately was rejected because it would starve later PRs and lose the bounded-scan contract; weakening or removing the unavailable-repository exception was rejected because legitimately unenrolled repositories remain externally non-actionable.

Validation

• python scripts/ci/pr_review_merge_scheduler.py --self-test
• deterministic direct probes: one error followed by an unaffected PR, multiple errors, and no-error success
• python -m compileall -q for production and changed tests
• git diff --check
• exact-head CI and security evidence required before merge

Fixes #894