ci(mind): self-heal stale complete/index.md on push to main

[Jammy2211]

Closes #116.

Overview

The Lifecycle Drift workflow's index --check was alarm-only: while complete/index.md was stale it failed — and emailed — on every push to main until something regenerated the index. Three storms so far (2026-07-24 → #97; 2026-07-30 morning → aba2ce5; 2026-07-30 evening → fa35972, ~25 emails in 2h). The third break was an ad-hoc git mv of 10 phase prompts into complete/ after record --apply had regenerated the index — no amount of folding registry writes into lifecycle.py can prevent manual mutations, and with many concurrent agent sessions they will keep happening. So the check now repairs instead of alarming.

Changes (single file: .github/workflows/lifecycle_drift.yml)

• Push to main + stale index → self-heal: fetch the current tip of main, regenerate with index --apply, verify convergence with index --check, commit complete/index.md as github-actions[bot], push. Up to 3 attempts, each rebuilt from the fresh tip, so a concurrent push never needs rebase/conflict handling; if a concurrent push already healed main, exit green without committing.
• Fails (and emails) only when the repair fails: index --apply not converging (a lifecycle.py bug) or the push still rejected after 3 attempts.
• Pull requests: unchanged read-only behaviour — fail with the "run index --apply" message.
• Semantic lifecycle.py check: unchanged hard fail (state contradictions are not auto-fixable).
• permissions: contents: write (required for the heal push; PR runs never push).
• Loop safety: pushes made with the default GITHUB_TOKEN do not trigger workflow runs, and convergence is verified before pushing regardless.

Validation

• YAML parsed and the heal script bash -n checked.
• End-to-end simulation against a scratch bare origin whose main tip was the real failing commit fa35972: the heal regenerated the 10 missing entries (823 → 833 records), committed as the bot identity, and pushed — exit 0.
• PR path: stale index with GITHUB_EVENT_NAME=pull_request → error annotation + exit 1.
• Race path: stale checkout but origin main already healed → "tip of main is already fresh", exit 0, no duplicate commit.
• lifecycle.py check + index --check pass on this branch.

Post-merge I'll run a controlled live test: push a deliberately index-stale (semantically valid) tweak directly to main and confirm the workflow pushes a bot heal commit instead of emailing.

🤖 Generated with Claude Code