ci: paginate the merge-group authority check, and never call a short read absent

[jason931225]

What happened

#820 was ejected from the merge queue with:

pull request #820 at 8f0b523f...: no authenticate-console-authority run on the queued head

It had one. The job ran on that exact SHA and concluded success:

$ gh run view <bootstrap-run> --json jobs
success  authenticate-console-authority

Root cause

repos/{repo}/commits/{sha}/check-runs returns 30 check runs per page by default. The call passed neither --paginate nor per_page. #820 had 32 — so the authority check sorted onto page two and disappeared.

Reproducible directly:

$ gh api ".../check-runs" --jq '.check_runs[].name' | grep -c authenticate         # 0
$ gh api ".../check-runs?per_page=100" --jq '.check_runs[].name' | grep -c authenticate   # 1

Why this matters beyond #820

Any PR with >30 check runs can be ejected, and whether it is depends on where the check happens to sort. The gate gets less reliable with every job added to CI. This is the gate whose verdict evicts work that already passed — it must not produce false negatives.

The fix — two parts

1. Paginate: --paginate with an explicit per_page=100.

2. Prove completeness rather than assume it. The gate now also reads the API's own total_count and refuses a short read with a different message:

   read only 30 of 32 check runs on the queued head; the list is incomplete,
   so absence of a run cannot be concluded
   

   A filter over a short list and a filter over a list that genuinely lacks the run return the same empty set. Reporting both as "no such run" is what turned a missing page into a missing gate. They demand opposite responses — retry vs. refuse — so they must not share a message.

Deliberately permissive where uncertainty is harmless: an unreadable total_count does not manufacture a failure, and more runs than the reported total is not treated as short (check runs can appear between the two calls).

Verification

mutation: remove short-read guard	"an incomplete read is not reported as a missing run" → RED
restore	→ green
tests	14 pass (5 pre-existing, 9 new)
gate sweep	12 passed, 0 failed

🤖 Generated with Claude Code