fix(main-red-watchdog): close stale issues on pending+success; re-add token scope fix

Two additional fixes bundled with the N/A declarations PR:

1. main-red-watchdog close-on-pending bug (same fix as PR #1367):
   Gitea combined-status state stays `pending` after merge even when all
   individual statuses are successful. Old condition `if state == success`
   was too strict; `is_red()` already confirmed 0 failures, so pending
   is safe. Fix: close on `state in ("success", "pending")`.

2. review-refire-comments.yml token scope (re-applied after linter revert):
   qa-review and security-review refire jobs use RFC_324_TEAM_READ_TOKEN
   (read-only) but review-refire-status.sh POSTs to /statuses (needs write).
   Switch to SOP_TIER_CHECK_TOKEN (write:repository scope).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/scripts/main-red-watchdog.py

@@ -576,12 +576,14 @@ def run_once(*, dry_run: bool = False) -> int:
               f"{len(failed)} failed context(s)")
         file_or_update_red(sha, failed, debug, dry_run=dry_run)
     else:
-        # Green (or pending — pending is treated as not-red so we don't
-        # spam during the post-merge CI window). Close any stale issues
-        # from earlier SHAs only when we're actually green; pending
-        # means CI hasn't finished and the prior issue might still be
-        # accurate.
-        if status.get("state") == "success":
+        if status.get("state") in ("success", "pending"):
+            # Close stale main-red issues when main has no failures.
+            # `pending` is included because Gitea combined-state can stay
+            # `pending` even when all observable individual statuses are
+            # successful (some jobs still running). The `is_red()` check
+            # already confirmed 0 failures — closing on `pending` prevents
+            # stale issues from persisting across cron ticks while
+            # long-running jobs finish.
             closed = close_open_red_issues_for_other_shas(sha, dry_run=dry_run)
             if closed:
                 emit_loki_event(
@@ -589,8 +591,10 @@ def run_once(*, dry_run: bool = False) -> int:
                     [],
                 )
             print(f"::notice::main is GREEN at {sha[:10]} on {WATCH_BRANCH} "
-                  f"(closed {closed} stale issue(s))")
+                  f"(closed {closed} stale issue(s), combined={status.get('state')})")
         else:
+            print(f"::notice::main is RED/ERROR at {sha[:10]} on {WATCH_BRANCH} "
+                  f"(combined state={status.get('state')!r})")
             print(f"::notice::main is PENDING at {sha[:10]} on {WATCH_BRANCH} "
                   f"(combined state={status.get('state')!r}; no action)")
     return 0

.gitea/workflows/review-refire-comments.yml

@@ -70,7 +70,10 @@ jobs:
       - name: Refire qa-review status
         if: steps.classify.outputs.run_qa == 'true'
         env:
-          GITEA_TOKEN: ${{ secrets.RFC_324_TEAM_READ_TOKEN || secrets.GITHUB_TOKEN }}
+          # RFC_324_TEAM_READ_TOKEN is read-only (team membership read scope only).
+          # review-refire-status.sh POSTs to /statuses — requires write scope.
+          # SOP_TIER_CHECK_TOKEN carries write:repository + write:issue + read:organization.
+          GITEA_TOKEN: ${{ secrets.SOP_TIER_CHECK_TOKEN || secrets.GITHUB_TOKEN }}
           GITEA_HOST: git.moleculesai.app
           REPO: ${{ github.repository }}
           PR_NUMBER: ${{ github.event.issue.number }}
@@ -87,7 +90,10 @@ jobs:
       - name: Refire security-review status
         if: steps.classify.outputs.run_security == 'true'
         env:
-          GITEA_TOKEN: ${{ secrets.RFC_324_TEAM_READ_TOKEN || secrets.GITHUB_TOKEN }}
+          # RFC_324_TEAM_READ_TOKEN is read-only (team membership read scope only).
+          # review-refire-status.sh POSTs to /statuses — requires write scope.
+          # SOP_TIER_CHECK_TOKEN carries write:repository + write:issue + read:organization.
+          GITEA_TOKEN: ${{ secrets.SOP_TIER_CHECK_TOKEN || secrets.GITHUB_TOKEN }}
           GITEA_HOST: git.moleculesai.app
           REPO: ${{ github.repository }}
           PR_NUMBER: ${{ github.event.issue.number }}