fix: retry the merged pull request lookup before refusing a production push

[leynier]

Summary

The Cloud Deploy run for the merge of #929 (run 38094043602) failed at Authorize Production SHA: "Refusing a direct push: eaef88b… is not the merge commit of a PR merged into main". The commit is the merge commit of #929.

GitHub links a merge commit to its pull request a few seconds after the push. The gate called commits/<sha>/pulls once, 6 seconds after the merge, and got no pull request. The same query returns #929 now. 51edc40de failed the same way on 2026-10-08 (run 37708708117).

The gate now asks up to seven times, 10 seconds apart (about a minute, well inside the job's 5-minute timeout), before refusing. The refusal itself and every other check are unchanged. docs/cloud-operations.md says so.

Screenshots

No visual change.

Testing

• Workflow YAML parses and the step's script passes bash -n.
• The lookup on eaef88ba now returns feat: bring the mcp to parity with the app and cli #929, which a retried check would have found.
• Not run: the workflow itself. It only runs on main and would deploy production.

Security Audit

• The authorization is no weaker. A direct push still has no merged pull request after every attempt and is still refused.
• No new permissions, actions, or secrets.

Notes

#929 is merged but not deployed: Deploy Production was skipped. Deploying needs either a re-run of the failed run (its retried authorization now passes) or the push that merging this PR causes. Either one deploys main to production, including #929. Webhooks stay off until ALERA_WEBHOOK_SECRET_KEY is configured, and MCP_EVENTS_ENABLED defaults to off.

[pullfrog]

✅ No new issues found.

Reviewed changes

Reviewed the production push authorization retry and the matching operations note.

• Merge lookup retry: On a push, Authorize Production SHA now queries commits/<sha>/pulls up to seven times, ten seconds apart, before refusing a SHA that is not yet the merge commit of a pull request merged into main.
• Runbook: docs/cloud-operations.md records that the check waits about a minute for GitHub to link the merge commit.

  ^{｜ View workflow run ｜ Using grok-4.7 ｜ 𝕏}