fix: tighten code queue pr preflight contract

src/components/microservices/code-queue/src/runtime-preflight.ts

@@ -55,10 +55,17 @@ export interface RuntimePreflightReport {
   pullRequestDelivery: PullRequestDeliveryPreflight;
 }
 
+export interface UniDeskGhCliStatus {
+  ok: boolean;
+  path: string;
+  present: boolean;
+}
+
 export interface PullRequestDeliveryPreflight {
   ok: boolean;
   checkedAt: string;
   tools: Record<string, RuntimeToolStatus>;
+  unideskGhCli: UniDeskGhCliStatus;
   credentials: {
     ghTokenPresent: boolean;
     githubTokenPresent: boolean;
@@ -235,6 +242,13 @@ function fileExistsProbe(path: string): boolean {
   return shellProbe(`test -s ${shellQuote(path)}`, 2000).ok;
 }
 
+function unideskGhCliStatus(): UniDeskGhCliStatus {
+  const root = gitValue(["rev-parse", "--show-toplevel"]) ?? process.cwd();
+  const path = `${root.replace(/\/+$/u, "")}/scripts/cli.ts`;
+  const present = fileExistsProbe(path);
+  return { ok: present, path, present };
+}
+
 function parseGitHubRepo(remote: string | null): string | null {
   const envRepo = process.env.GH_REPO?.trim();
   if (envRepo !== undefined && /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u.test(envRepo)) return envRepo;
@@ -370,6 +384,7 @@ function collectPullRequestDeliveryPreflight(options: RuntimePreflightOptions, c
     ssh: toolStatus("ssh", ["-V"]),
     curl: toolStatus("curl", ["--version"]),
   };
+  const unideskGhCli = unideskGhCliStatus();
   const insideProbe = commandProbe("git", ["rev-parse", "--is-inside-work-tree"], { timeoutMs: 5000 });
   const insideWorktree = insideProbe.ok && firstLine(insideProbe.stdout) === "true";
   const home = process.env.HOME ?? null;
@@ -452,7 +467,8 @@ function collectPullRequestDeliveryPreflight(options: RuntimePreflightOptions, c
   const risks: string[] = [];
   if (!tools.git.ok) limitations.push("missing git CLI");
   if (!tools.jq.ok) limitations.push("missing jq CLI");
-  if (!tools.gh.ok && !tools.hub.ok) limitations.push("missing PR CLI: install gh or hub");
+  if (!tools.gh.ok) risks.push("system gh binary is missing; UniDesk REST gh CLI remains the supported PR create/comment path when scripts/cli.ts and GH_TOKEN/GITHUB_TOKEN are available");
+  if (!unideskGhCli.ok) limitations.push("UniDesk gh CLI is missing at scripts/cli.ts; runner cannot use the repo-native REST PR create/comment path");
   if (!credentials.ghTokenPresent && !credentials.githubTokenPresent) limitations.push("GH_TOKEN/GITHUB_TOKEN is not present; gh cannot create PRs unless another gh credential store is mounted");
   if (!credentials.ghHostsConfigPresent && !credentials.gitCredentialsPresent && !credentials.ghTokenPresent && !credentials.githubTokenPresent) limitations.push("no gh hosts config, git credentials file, GH_TOKEN, or GITHUB_TOKEN is visible for GitHub API/issue/PR access");
   if (!gitInfo.insideWorktree) limitations.push("current directory is not a Git worktree");
@@ -476,7 +492,7 @@ function collectPullRequestDeliveryPreflight(options: RuntimePreflightOptions, c
   }
   if (pushDryRun !== undefined && !pushDryRun.ok) limitations.push("git push --dry-run failed for probe branch");
   if (prCreateDryRun !== undefined && !prCreateDryRun.ok) limitations.push("PR create dry-run body/command guard failed");
-  const prCliReady = tools.gh.ok || tools.hub.ok;
+  const prCliReady = unideskGhCli.ok;
   const tokenOrGhStore = credentials.ghTokenPresent || credentials.githubTokenPresent || credentials.ghHostsConfigPresent || (remote?.ghAuthStatus?.ok === true);
   const remoteReady = remote === undefined || (egress.githubDefault.ok && egress.apiDefault.ok && remote.gitLsRemote.ok && remote.githubSshAuthenticated);
   const pushReady = pushDryRun === undefined || pushDryRun.ok;
@@ -485,6 +501,7 @@ function collectPullRequestDeliveryPreflight(options: RuntimePreflightOptions, c
     ok: tools.git.ok && tools.jq.ok && prCliReady && tokenOrGhStore && gitInfo.insideWorktree && gitInfo.remoteOrigin !== null && gitInfo.homeWritable && remoteReady && pushReady && prCreateDryRunReady,
     checkedAt,
     tools,
+    unideskGhCli,
     credentials,
     githubContext: {
       host: githubHost,