fix: bind CI evidence to pull request head

.github/workflows/ci.yml

@@ -14,6 +14,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
+  CANDIDATE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
   PIP_DISABLE_PIP_VERSION_CHECK: "1"
   PIP_NO_INPUT: "1"
   UV_VERSION: "0.12.4"
@@ -357,7 +358,7 @@ jobs:
           "$TEST_ENV/bin/python" scripts/write_test_evidence.py \
             --coverage "test-results/coverage-py${{ matrix.python-version }}.json" \
             --junit "test-results/junit-py${{ matrix.python-version }}.xml" \
-            --head-sha "$GITHUB_SHA" \
+            --head-sha "$CANDIDATE_SHA" \
             --base-sha "$COVERAGE_BASE" \
             --python-version "${{ matrix.python-version }}" \
             --output "test-results/test-trend-py${{ matrix.python-version }}.json" \
@@ -512,7 +513,7 @@ jobs:
             evidence_args+=(--mutation quality-evidence/mutation-stats.json)
           fi
           "$QUALITY_ENV/bin/python" scripts/write_test_evidence.py \
-            --head-sha "$GITHUB_SHA" \
+            --head-sha "$CANDIDATE_SHA" \
             --base-sha "$COVERAGE_BASE" \
             --python-version "3.12" \
             --output quality-evidence/quality-trend-py3.12.json \

tests/test_ci_policy.py

@@ -121,6 +121,14 @@ def test_ci_retains_normalized_test_and_quality_trends_for_ninety_days():
     assert workflow.count("retention-days: 90") >= 2
 
 
+def test_ci_evidence_names_the_pull_request_head_not_the_synthetic_merge_commit():
+    workflow = WORKFLOW.read_text(encoding="utf-8")
+
+    assert "CANDIDATE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}" in workflow
+    assert workflow.count('--head-sha "$CANDIDATE_SHA"') == 2
+    assert '--head-sha "$GITHUB_SHA"' not in workflow
+
+
 def test_ci_runs_checkpoint_portability_contracts_on_windows():
     workflow = WORKFLOW.read_text(encoding="utf-8")
     checkpoint_job = workflow.split("  checkpoint-windows:\n", maxsplit=1)[1].split(