fix: classify transient GitHub connectivity

Merge PR #102 after rebasing onto current master and validating focused GitHub transient/Code Queue preflight behavior. GitHub DNS/API failures now classify as retryable github-transient with retry/backoff or keep-fresh-heartbeat-task guidance.

scripts/code-queue-pr-preflight-contract-test.ts

@@ -546,6 +546,69 @@ async function main(): Promise<void> {
   assertCondition(proxyGapRecord.failureKind === "proxy-gap", "proxy failures should classify as proxy-gap", proxyGapRecord);
   assertCondition(proxyGapRecord.degradedReason === "configured GitHub egress proxy host is not resolvable: missing-egress-proxy.unidesk.svc.cluster.local", "proxy degraded reason should point at the proxy", proxyGapRecord);
 
+  const githubTransientContract = await codexPrPreflightQueryForTest(["--remote"], {
+    config: null,
+    coreFetch: () => ({
+      ok: true,
+      status: 200,
+      body: {
+        runtimePreflight: rawRuntimePreflightFixture({
+          ok: false,
+          pullRequestDelivery: {
+            ...asRecord(rawRuntimePreflightFixture().pullRequestDelivery),
+            ok: false,
+            credentials: {
+              ghTokenPresent: true,
+              githubTokenPresent: false,
+              ghHostsConfigPresent: false,
+              gitCredentialsPresent: false,
+            },
+            egress: {
+              proxy: {
+                selectedProxyHost: "d601-provider-egress-proxy.unidesk.svc.cluster.local",
+                selectedProxyPort: "18789",
+                selectedProxyHostResolvable: true,
+              },
+              githubDefault: { command: "curl", args: ["-IsS", "https://github.com"], ok: false, exitCode: 6, signal: null, error: null, stdout: "", stderr: "curl: (6) Could not resolve host: github.com" },
+              apiDefault: { command: "curl", args: ["-IsS", "https://api.github.com"], ok: false, exitCode: 6, signal: null, error: null, stdout: "", stderr: "curl: (6) Could not resolve host: api.github.com" },
+              issueApi: null,
+            },
+            remote: {
+              gitLsRemote: { command: "git", args: ["ls-remote", "--heads", "origin", "master"], ok: false, exitCode: 128, signal: null, error: null, stdout: "", stderr: "ssh: Could not resolve hostname github.com: Temporary failure in name resolution" },
+              gitHttpsLsRemote: null,
+              githubSshAuthenticated: false,
+              ghAuthStatus: { command: "gh", args: ["auth", "status"], ok: false, exitCode: 1, signal: null, error: null, stdout: "", stderr: "error connecting to api.github.com" },
+              ghRepoView: null,
+              ghIssueView: null,
+              ghPrReadOnly: null,
+            },
+            limitations: [
+              "GitHub HTTPS probe failed with the default environment/proxy",
+              "GitHub API probe failed with the default environment/proxy",
+              "git ls-remote origin master failed",
+            ],
+            risks: [],
+          },
+        }),
+      },
+    }),
+  });
+  const githubTransientRecord = asRecord(githubTransientContract);
+  assertCondition(githubTransientRecord.failureKind === "github-transient", "GitHub DNS/API failures should classify separately from auth and semantic failures", githubTransientRecord);
+  assertCondition(githubTransientRecord.degradedReason === "github-dns-api-transient", "GitHub transient degraded reason should be stable", githubTransientRecord);
+  assertCondition(githubTransientRecord.runnerDisposition === "infra-blocked", "GitHub transient keeps infra-blocked disposition for legacy callers", githubTransientRecord);
+  assertCondition(githubTransientRecord.retryable === true, "GitHub transient should expose top-level retryable=true", githubTransientRecord);
+  assertCondition(githubTransientRecord.commanderAction === "retry-backoff-or-keep-running-if-heartbeat-fresh", "GitHub transient should expose top-level commander action", githubTransientRecord);
+  const githubTransientPreflight = asRecord(githubTransientRecord.preflight);
+  assertCondition(githubTransientPreflight.retryable === true, "GitHub transient preflight should be retryable", githubTransientPreflight);
+  assertCondition(githubTransientPreflight.commanderAction === "retry-backoff-or-keep-running-if-heartbeat-fresh", "GitHub transient should expose bounded commander action", githubTransientPreflight);
+  const githubTransient = asRecord(githubTransientPreflight.githubTransient);
+  assertCondition(githubTransient.kind === "github-transient", "GitHub transient evidence should identify kind", githubTransient);
+  assertCondition(githubTransient.notAuthMissing === true, "GitHub transient must not be auth-missing", githubTransient);
+  assertCondition(githubTransient.notPrSemanticFailure === true, "GitHub transient must not be PR semantic failure", githubTransient);
+  assertCondition(Array.isArray(githubTransient.failedProbes) && githubTransient.failedProbes.length <= 4, "GitHub transient evidence should stay bounded", githubTransient);
+  assertCondition(String(githubTransient.commanderAction ?? "").includes("keep the task running"), "GitHub transient action should preserve fresh-heartbeat tasks", githubTransient);
+
   let observedDryRunPath = "";
   const dryRunContract = await codexPrPreflightQueryForTest([
     "--remote",
@@ -820,6 +883,7 @@ async function main(): Promise<void> {
       "local backend-core absence returns runner-local-observation-gap",
       "auth missing returns auth-missing with broker/auth-broker-needed",
       "proxy failures return proxy-gap",
+      "GitHub DNS/API failures return github-transient with retry/backoff guidance",
       "git remote failures return git-remote-gap",
       "combined push/PR create dry-run contract stays read-only and separates system gh from UniDesk gh CLI",
       "broker-issued token, env-token, and missing-token branches expose authBroker source/capability/nextAction",