chore: switch to ai-inference v3 and fail workflows on 410

.github/workflows/pr-ai-policy.yml

@@ -134,7 +134,8 @@ jobs:
             -d "$PAYLOAD" || echo "000")
 
           if [ "$STATUS" != "200" ]; then
-            echo "::warning::GitHub Models returned HTTP $STATUS; treating as compliant"
+            echo "::error::GitHub Models returned HTTP $STATUS; treating as compliant"
+            printf '%s\n' "inference call failed with HTTP $STATUS" >> /tmp/ai-degraded
             echo '{"compliant": true, "violations": []}' > /tmp/result.json
             exit 0
           fi
@@ -146,7 +147,8 @@ jobs:
           # The deterministic trailer scan still stands on its own below.
           sed -E 's/^```(json)?$//; s/```$//' /tmp/raw.txt > /tmp/result.json
           if ! jq -e . /tmp/result.json >/dev/null 2>&1; then
-            echo "::warning::Model returned non-JSON; treating as compliant"
+            echo "::error::Model returned non-JSON; treating as compliant"
+            printf '%s\n' "model returned output that was not JSON" >> /tmp/ai-degraded
             echo '{"compliant": true, "violations": []}' > /tmp/result.json
           fi
           echo "Policy response validated"
@@ -205,3 +207,16 @@ jobs:
         run: |
           gh pr comment "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" --body-file /tmp/comment.md
           gh pr close "$PR_NUMBER" --repo "$GITHUB_REPOSITORY"
+
+      # The steps above deliberately degrade rather than block: an inference
+      # outage must never close a contributor's issue or flag their pull
+      # request. But a run that skipped the check it exists to perform has not
+      # succeeded, and reporting green hides that the automation is dead.
+      - name: Fail if the AI check did not actually run
+        if: always()
+        run: |
+          if [ -f /tmp/ai-degraded ]; then
+            echo "::error::This check degraded to a no-op and its result was not verified:"
+            sed 's/^/  - /' /tmp/ai-degraded
+            exit 1
+          fi