Tooling: skip the PR preview publish when the head has moved on

[epeicher]

What it does

Turns a benign race in PR Preview Publish from a red run into a green one with a warning annotation.

The workflow resolves the PR from the trusted workflow_run payload and requires the PR's head to still be the exact commit the build ran on. Push a second commit while the first preview build is running, and that commit is superseded before the publish job starts. The lookup matches nothing and the step calls core.setFailed.

Rationale

Nothing is actually broken when it happens. The newer commit's own build/publish pair posts the preview, the job attaches no check run to the PR, and it is not among the trunk ruleset's required checks.

The cost is noise, in the one place noise is expensive. workflow_run runs are attributed to the default branch, so every race paints a red run in the trunk Actions tab. It fired twice in two days, on #794 and on a codex/agent-async-jobs push the day before, and it will fire whenever anyone pushes twice in quick succession. A red trunk run that routinely means nothing is a red trunk run people stop reading.

Timeline of the #794 case:

Time (UTC)	Event
08:33:16	Preview build starts on 5d4b4f6d
08:34:56	Force push, head becomes a2d67cc5, new build starts
08:35:03	Publish fires for the 5d4b4f6d build, finds no matching head, fails
08:36:34	Publish for a2d67cc5 succeeds and posts the preview

Implementation

core.warning and an early return replace core.setFailed in the no-match branch. The four steps that need a PR number are gated on steps.meta.outputs.pr-number != '', so the job ends green with an annotation naming the branch and the SHA that moved on.

Two things deliberately not done:

• The head SHA equality check stays. Relaxing it to owner plus branch would make the race "succeed", but it would publish the superseded build under the current PR. A reviewer clicking that preview link would get older code than the PR shows. Skipping is the right outcome here, not a workaround for it.
• The loud failures stay loud. A malformed head SHA or incomplete head data still calls setFailed, and an API or permission error throws out of paginate rather than returning an empty list, so it surfaces as a step error and not as a silent skip.

The trust model is untouched: a preview is still only ever published to a PR positively identified from the workflow_run payload, never from artifact bytes.

Testing instructions

The workflow only runs from the default branch, so the skip path is exercised after merge rather than on this PR.

• The preview build and publish pair for this PR should behave exactly as before, since its head is not racing anything.
• Next time a push lands while a preview build is running, the publish run should be green with a No pull request for …; the head has moved on, skipping the preview. annotation, and the later run should post the preview as usual.