fix(ci): isolate sync parser and lease

[Eli Pinkerton (wallstop)]

Summary

• clear the trusted verifier temp directory before validation installs
• authenticate first, observe the exact remote sync-branch tip, and push with an explicit expected-SHA lease

Verification

• actionlint
• absent/exact/stale remote-branch lease scenarios
• git diff --check
• adversarial review: zero issues

---

Note

Low Risk
CI-only changes to push leasing and temp-dir cleanup; no application runtime or auth logic is modified.

Overview
Tightens the Upstream Sync workflow so automated doc-sync pushes and contract checks are less race-prone.

On the discover job, the pre-push git fetch of the sync branch is removed. After gh auth setup-git, the workflow reads the current remote tip with git ls-remote and force-with-lease pushes using that exact expected SHA, so a concurrent update fails the push instead of overwriting blindly.

In validate, the trusted verifier install step now rm -rf /tmp/upstream-verifier before recreating it, matching discover’s verify_contract behavior so stale parser installs cannot leak across runs on the same runner.

^{Reviewed by Cursor Bugbot for commit e80435b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Eli Pinkerton (wallstop)]

Cursor (@cursor) review exact commit e80435b. Please report every issue, including minor findings, or explicitly state zero issues.

[Eli Pinkerton (wallstop)]

copilot-pull-request-reviewer review exact commit e80435b. Please report every issue, including minor findings, or explicitly state zero issues.

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit e80435b. Configure here.}

[Copilot]

Pull request overview

Tightens the Upstream Sync GitHub Actions workflow to reduce race conditions during sync-branch updates and to prevent stale verifier/parser installs from leaking across runs.

Changes:

• Replaces the pre-push git fetch + implicit lease behavior with an explicit remote-tip read (git ls-remote) and an explicit --force-with-lease=<ref>:<expected-sha> push.
• Clears /tmp/upstream-verifier before installing the trusted verifier parser in the validate job (matching the existing discover.verify_contract behavior).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.