ci: scope commitizen bump detection, tag only merged bumps, stop cancelling pending bumps

[devin-ai-integration]

Summary

keycardai-mcp was released as 3.0.0 on Aug 28 when it should have been 2.2.0. Three independent defects in the release automation combined to produce it; this PR closes all three. Workflow/config only — no package version is bumped, and ci/build-scoped commits (i.e. this PR) do not trigger a release.

Defect 1 — a queued merge cancelled a pending bump. main.yml shared one concurrency group across every push to a branch, and a group only ever holds a single pending run: when PR #245 landed, its run replaced the still-queued run for 6350810 (PR #246), so keycardai-mcp's bump never fired. cancel-in-progress: false alone did not help — the cancellation happens in the pending slot. Fix: one group per commit, so each merge bumps its own packages.

Evidence note: run 33224003769 shows failure today because the incident-day recovery rerun (attempt 2) overwrote the conclusion; attempt 1 is the record for this defect — cancelled, zero jobs started. Attempt 2 also exposed two more problems this PR fixes: the old bump script treated NO_COMMITS_FOUND as a crash instead of a clean no-op (now handled alongside NO_COMMITS_TO_BUMP), and the matrix's default fail-fast cancelled the sibling package's bump when one job failed (fail-fast: false added, review round). The review round also documents the scoped breaking-change requirement in CLAUDE.md and adds the root package to the increment tests.

-group: release-${{ github.ref_name }}
+group: release-${{ github.ref_name }}-${{ github.sha }}
 cancel-in-progress: false

Since runs for the same package can now overlap, bump-package.yml's job gets concurrency: bump-<package_name>-<target_branch> with cancel-in-progress: false so same-package bumps still serialise on the bump branch/tag.

Defect 2 — increment detection ignored the commit scope. Each package set only changelog_pattern under [tool.commitizen.customize]; with no bump_pattern/bump_map, commitizen falls back to its default classifier (^((BREAKING[- ]CHANGE|\w+)(\(.+\))?!?): + default map), which majors on any feat(...)!:. The feat(keycardai-oauth)!: multi-resource web-app flow commit sat in keycardai-mcp's window, so the manual workflow_dispatch recovery logged increment detected: MAJOR and shipped 3.0.0. Every pyproject.toml now scopes detection to its own package:

bump_pattern = "^((?:feat|fix|refactor|perf|revert|BREAKING[\\- ]CHANGE)\\(keycardai-mcp\\)!?):"

[tool.commitizen.customize.bump_map]
"^.+\\(keycardai-mcp\\)!$" = "MAJOR"
"^BREAKING[\\- ]CHANGE" = "MAJOR"
"^feat" = "MINOR"
"^fix" = "PATCH"     # refactor/perf/revert likewise

bump_map_major_version_zero mirrors it with MINOR for breaking changes, preserving today's pre-1.0 behaviour for the major_version_zero = true packages. changelog_pattern drops build|ci so CI-only commits are not release-relevant.

scripts/test_bump_increment.py (new, wired into CI via just test-release-tooling) builds throwaway git repos from each package's real commitizen block and asserts increments through cz bump --dry-run: the 3.0.0 scenario (feat(keycardai-oauth)! + fix(keycardai-mcp)) now yields 2.1.1, a sibling breaking commit alone yields no bump, own !/BREAKING CHANGE footers still major, and ci/build/test/chore/docs commits produce neither a bump nor a changelog entry.

Defect 3 — the tag was created even though the bump PR never merged. When branch policy refused the direct merge of bump PR #250, wait_for_pr_merge fell back to gh api -X PATCH repos/<repo>/git/refs/heads/main -f sha=<PR head>, i.e. it force-moved the branch outside the policy and then tagged, publishing 3.0.0 before the bump landed and leaving main's version file behind PyPI. That fallback is deleted: a refused merge now leaves auto-merge armed, and the poll returning None fails the job with the PR link and no tag, so a tag can only ever point at a real merge commit.

Regression tests in scripts/test_bump_package.py assert that a refused merge touches neither PATCH nor git/refs, and that an unmerged bump PR never reaches create_and_push_tag.

Verified: just check, just test-coverage, just test-release-tooling (18 tests), and scripts/version_preview.py reports [] for this branch (no release). just typecheck is not runnable here or in CI — ty is not a declared dependency.

Link to Devin session: https://app.devin.ai/sessions/6a25aef8314d4d7aa459521d0dac768a
Open in Devin Desktop: https://app.devin.ai/desktop/session/6a25aef8314d4d7aa459521d0dac768a?variant=devin
Requested by: @Larry-Osakwe

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[Larry-Osakwe]

Reviewed against the authoring prompt plus a follow-up fix round (fail-fast, scoped-breaking docs, root package coverage). Attempt-level evidence for the incident narrative is in the description.