Release approval selector rejects GitHub’s completed/action_required run shape

[jim80net]

Measured post-merge dogfood

After PR #28 merged cleanly, Release Please run 30975621178 created the release PR and entered the held-run approval helper. The exact CI run is visible through the Actions API:

{
  "id": 30975665295,
  "event": "pull_request",
  "head_branch": "release-please--branches--main--components--memex-openclaw",
  "head_sha": "d7d30d125d721bbdbb5a30f2768041bdf47dbf5e",
  "status": "completed",
  "conclusion": "action_required"
}

Observed at 2026-08-05T04:39Z during independent post-merge dogfood.

Root cause

selectHeldPullRequestRun currently requires run.status === "action_required". GitHub represents the live held run as status === "completed" and conclusion === "action_required", so the exact run is visible but permanently rejected by the selector. The current tests model the wrong payload shape.

The helper is failing closed as designed. Do not manually approve run 30975665295, release, or deploy while reproducing this issue.

Acceptance

• Select and approve only the exact branch/SHA pull_request run with status: "completed" and conclusion: "action_required".
• Update the workflow-run type to model conclusion.
• Add the measured live-shape regression.
• Retain exact branch, SHA, event, valid-id, and ambiguity controls.
• Reject status: "completed", conclusion: "success" with zero approval requests.
• Reject an otherwise exact run with any wrong or missing conclusion with zero approval requests.
• Keep the genuinely-no-run and dispatch-only paths fail closed.
• Full adapter and hosted gates green; independent review/merge only.

No release or deployment is part of this repair.