ci: the back-merge no longer enables auto-merge (backport #4619)

[kixelated]

Backport of #4619 (8ec88b05b) to release, sh/gh/back-merge.sh only.

Problem

The Back-merge workflow runs from release, so it executes release's copy of sh/gh/back-merge.sh. That copy still ends with gh pr merge --auto --merge. Once main moves to the squash-only merge queue, auto-merge would squash the back-merge PR, and the next back-merge would conflict. This blocks flipping ruleset 2420853 (tracked in quest/m1/merge-queue-settings.md on main).

Approach

• sh/gh/back-merge.sh now matches main byte for byte: it opens or refreshes the PR and stops. main's Check land job already merges it with --merge --admin once Check and Test pass (it landed chore: merge release into main #5102).
• Callers are unchanged: release's back-merge.yml runs just gh back-merge, which runs the script with no arguments and the same GH_TOKEN/GITHUB_REPOSITORY env.
• Dropped from ci: validate required checks on merge groups #4619: the comment-only edits to .github/justfile and .github/workflows/back-merge.yml (the next cut carries them), and the check.yml, alert.yml, CONTRIBUTING.md, and quest changes, which act on main or are docs.

Impact

• No public API or wire change.
• CI: the back-merge PR no longer gets auto-merge from the workflow; main's land job remains the only merger.

Alternatives

• Cherry-picking all of ci: validate required checks on merge groups #4619: its check.yml/alert.yml changes are for main's merge queue and conflict with release's workflows for no benefit.

Follow-ups

• After this merges, the maintainer flips ruleset 2420853 (merge queue with Squash, plus moq-bot pull_request bypass), per the quest.

Test evidence

• shellcheck sh/gh/back-merge.sh: clean.
• just check against origin/release: passes.

(Written by Claude Opus 5.5)

🤖 Generated with Claude Code

[kixelated]

Automated review by review (OpenAI)

Reviewed commit: 65b6617

No actionable findings in the full single-file diff. The script-only backport is the right scope: its blob matches current main, the release workflow still supplies the required app token/environment, and main already has a same-repository, branch/base-gated land job that waits for Check/Test and pins the merge to the checked head. Removing the competing auto-merge path is simpler than backporting the unrelated workflow changes. No public API or wire impact.

Verification: GitHub-only static review of the complete script and relevant callers/landing workflow. GitHub reports Check, Test, and Platform successful for this head. I did not execute the script or exercise the live merge-queue transition; that still depends on the documented moq-bot bypass configuration.

(Written by OpenAI)

[kixelated]

Merge summary for 65b661758da5024adb0345db15062fd4bc0092c5:

• Backport of ci: validate required checks on merge groups #4619 onto release, sh/gh/back-merge.sh only; the script is byte-identical to main's.
• The Back-merge workflow (which runs release's copy) now opens or refreshes the back-merge PR and stops. main's Check land job is the only merger.
• Review: one OpenAI review of this head, no findings. CI: Check, Test, Windows, macOS pass.
• Merging as a merge commit, per CONTRIBUTING for PRs into release.
• quest/m1/merge-queue-settings.md stays on main: the maintainer still flips ruleset 2420853 and then checks how Dependabot PRs go through the queue.

(Written by Claude Opus 5.5)

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-10T00:32:15.703521Z	65b6617	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.