ci(seed): keep maintainer commits on the open seed PR, publish only from main, survive long ratchet reports

/review on #3253 (gpt-6.1-sol): a refresh force-pushed over maintainer repairs
on the seed PR, a dispatch from a feature branch would publish that branch's
commits, and grep | head under pipefail could abort the step on a long ratchet
report. The refresh now leaves an open seed PR alone when it holds any commit
besides the bot's one refresh commit and pushes with an exact lease; only main
publishes; the report is cut with sed. Each has a functional test that fails on
the old workflow.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

.github/workflows/free-durations-record.yml

@@ -101,7 +101,7 @@ jobs:
       - name: Open or refresh the seed PR when either seed's file set changed
         env:
           GH_TOKEN: ${{ github.token }}
-          OPEN_PR: ${{ github.event_name == 'schedule' || inputs.open_pr }}
+          OPEN_PR: ${{ github.ref == 'refs/heads/main' && (github.event_name == 'schedule' || inputs.open_pr) }}
         run: |
           set -euo pipefail
           linux_failed=$(wc -l < "$RUNNER_TEMP/linux/record-failures.txt")
@@ -127,22 +127,32 @@ jobs:
           if ratchet=$(GSTACK_FREE_SEED_BASE="$(git rev-parse HEAD)" bun test test/free-seed-ratchet.test.ts 2>&1); then
             ratchet_line="passes"
           else
-            ratchet_line="FAILS; a maintainer must split the named file or add an annotated allowlist entry on this branch before merge:"$'\n\n'"\`\`\`"$'\n'"$(printf '%s\n' "$ratchet" | grep -E 'Free seed ratchet|^- ' | head -20)"$'\n'"\`\`\`"
+            ratchet_line="FAILS; a maintainer must split the named file or add an annotated allowlist entry on this branch before merge:"$'\n\n'"\`\`\`"$'\n'"$(printf '%s\n' "$ratchet" | sed -n -E '/Free seed ratchet|^- /p' | sed -n '1,20p')"$'\n'"\`\`\`"
           fi
           failed_line="Linux: $(failures "$RUNNER_TEMP/linux/record-failures.txt"); Windows: $(failures "$RUNNER_TEMP/windows/record-failures.txt")"
           echo "Seed growth ratchet: $ratchet_line" >> "$GITHUB_STEP_SUMMARY"
           echo "Failed while recording: $failed_line" | tee -a "$GITHUB_STEP_SUMMARY"
           if [ "$OPEN_PR" != true ]; then
-            echo "open_pr=false: recorded and reported only." | tee -a "$GITHUB_STEP_SUMMARY"
+            echo "Report only (open_pr=false, or a ref other than main): no branch pushed." | tee -a "$GITHUB_STEP_SUMMARY"
             exit 0
           fi
           branch=bot/free-duration-seeds
+          subject="test(seed): refresh the free-suite duration seeds from the weekly recording"
+          number=$(gh pr list --head "$branch" --state open --json number -q '.[0].number // empty')
+          remote_head=
+          if git fetch -q origin "+refs/heads/$branch:refs/remotes/origin/$branch" 2>/dev/null; then
+            remote_head=$(git rev-parse "origin/$branch")
+          fi
+          if [ -n "$number" ] && [ -n "$remote_head" ] && [ "$(git log --format=%s "HEAD..$remote_head")" != "$subject" ]; then
+            echo "::warning::Seed PR #$number has commits besides the bot's one refresh commit; this run leaves them in place. Merge or close that PR and the next run refreshes the seeds." | tee -a "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
           git switch -C "$branch"
           git config user.name github-actions[bot]
           git config user.email 41898282+github-actions[bot]@users.noreply.github.com
           git add scripts/free-test-durations.json scripts/free-test-durations-windows.json
-          git commit -m "test(seed): refresh the free-suite duration seeds from the weekly recording"
-          git push --force origin "$branch"
+          git commit -m "$subject"
+          git push --force-with-lease="refs/heads/$branch:$remote_head" origin "HEAD:refs/heads/$branch"
           cat > pr-body.md <<EOF
           Weekly recording from run $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID on $GITHUB_SHA.
 
@@ -153,7 +163,7 @@ jobs:
 
           Data only. Stamp and merge per docs/ship-policy.md; the stamp push runs the full PR checks.
           EOF
-          if number=$(gh pr list --head "$branch" --state open --json number -q '.[0].number') && [ -n "$number" ]; then
+          if [ -n "$number" ]; then
             gh pr edit "$number" --body-file pr-body.md
           else
             gh pr create --base main --head "$branch" --title "test(seed): refresh the free-suite duration seeds" --body-file pr-body.md