ci: judge only the latest check run per name in auto-tag verify

[claude-dataviking]

What

Fixes the auto-tag "Verify CI checks passed" step so it judges only the latest check run per (app, name) on the merged head SHA, instead of every run ever parked there. Two side fixes ride along: root server.json is now staged in the version-bump commit, and semver-label.yml's self-heal rerun step is removed as redundant.

Why

The check-runs API returns runs from every check suite ever started on a SHA, and label events don't move the head. So the superseded pre-label opened run of Semver Label (red) — and even a stale in_progress Cloudflare Pages attempt — sat on the SHA forever and made verify refuse to tag. This blocked the first v1.6.0 attempt. GitHub's own merge box collapses check runs to the latest per name; verify now does the same.

Changes

• .github/scripts/verify-ci-checks.sh (new): the verify logic, extracted so it can be run standalone (read-only, REPO=... HEAD_SHA=... bash .github/scripts/verify-ci-checks.sh) against any SHA. Same gh api + jq style; groups by (app.slug, name), sorts by started_at with id as same-second tiebreak, takes the last, then applies the unchanged incomplete/failed rules (neutral/skipped still pass; the auto-tag check run is still excluded so a prior failed tagging attempt can't block its own recovery rerun).
• auto-tag.yml: verify step now calls the script; and the bump commit's git add gains root server.json — scripts/render_server_card.py rewrites it (two version slots) alongside the server card, but it was never staged, so it drifted on main and bit PR chore(release): pre-bump version artifacts to 1.6.0 (un-stall the release train) #583.
• semver-label.yml: the PR ci(semver-label): fresh-fetch labels + self-heal superseded runs; cut v1.6.0 on merge #584 self-heal step ("flip superseded non-green runs of this check green") is removed. It existed solely to appease the old count-everything verify. Required-check mergeability already uses the latest run per name natively, so nothing else needs it; removing it also drops the actions: write permission.

Validation (read-only, no release cut)

Ran old vs new logic against 9ebceaa (PR #584 head), using filter=all to reconstruct the pre-self-heal state:

Logic	Verdict
Old (count every run)	❌ ::error::1 check(s) still running (stale in_progress Cloudflare Pages attempt; a failure Semver Label pre-label run sits behind it)
New (latest per name)	✅ ignores 3 superseded runs, All CI checks passed

Also validated against SynthBench PR #334 head 1550a06 (old: ❌ 11 non-green; new: ✅) — same fix lands there in the sibling PR. The next natural release is the live proof; this PR is semver:skip so auto-tag short-circuits.

🤖 Generated with Claude Code