Provide protected local CI and Validator coverage for Planfile PRs

[tom-sapletta-com]

Finding

The local OneDev coordinator rejects a retry for semcod/planfile PR #80 with retry target is not a configured PR profile. GitHub checks are green, but they are not evidence of the protected local verification required for publication.

Plan

1. Add a protected Planfile PR profile that validates the exact head, base and merge result.
2. Execute the existing focused test suite and required Python matrix from an immutable, networkless image with pinned dependency inputs.
3. Deploy the profile and obtain a successful canary on a deliberately valid PR.
4. Record the Validator receipt bound to repository, PR, ticket, head SHA and approval key.

Acceptance

PRs are not merged on the basis of hosted checks alone; the independent local Validator can verify a current Planfile PR and report an auditable receipt.

[tom-sapletta-com]

The same deployment-contract gap is tracked centrally in https://github.com/subactor/onedev-agent/issues/341. Planfile local CI must use the resulting image/config receipt and canary before it becomes merge evidence.

[tom-sapletta-com]

Live retry after the executor image deployment (2026-09-14) returns blocked: retry target is not a configured PR profile for Planfile PR #80. This confirms #81 is the remaining prerequisite: the executor is healthy, while Planfile has no protected local profile yet.

[tom-sapletta-com]

Continuation 2026-09-15: Planfile PR #108 merged at GitHub merge commit eb18dfd after exact-head governance and Python 3.10/3.13 checks passed. The repository still has no configured OneDev profile; the optional ci-loop also failed before tests because pip could not resolve typer>=0.12. This keeps #81 open: add a pinned local profile and use locked/offline dependency inputs before treating local verification as publication evidence.

[tom-sapletta-com]

Exact-head Validator dry-run for Planfile PR #109 (ticket-086) is blocked by registry drift, not source tests: protected ruleset requires freshness, both governance checks and Python 3.10/3.13 in addition to ci-loop/notify, but the protected Validator registry declares only the latter two. No review/merge/status bypass was attempted. #81 therefore remains the required profile/registry reconciliation ticket.

[tom-sapletta-com]

Aktualizacja po PR #149: niezależny Validator przyjął dokładny HEAD 86ba52b39ed476712876050377f4a45231649212 i scalił PR do de135c4f95816645bdee701da1156241c2037e52 (receipt 5249528915). To potwierdza działanie ścieżki exact-head Validator.

Issue pozostaje otwarte, ponieważ wymagane onedev/local-verify nadal było czerwone: środowisko OneDev nie ma zainstalowanego subactor-procache, a pełna konfiguracja/deploy profilu i canary nie ma jeszcze pozytywnego dowodu. Kryterium zamknięcia: świeży canary dla Planfile z przechodzącym onedev/local-verify, zachowanym exact-head/base oraz receipt po publikacji profilu.