fix(ci): accept trusted legacy PR metadata

[cixzhang]

Summary

• validate PR analysis metadata through the shared trusted validator instead of requiring fields older open PRs never emitted
• retain exact PR number, source run ID, and head-prefix checks for legacy artifacts
• continue enforcing every exact identity field whenever it is present

Why

A live recovery for #5671 used a fresh trusted CI run, but its older branch emits the pre-proof pr-meta.json shape. Current default-branch publication rejected it before reaching the now-fixed tall screenshot.

Test plan

• pnpm exec vitest run .github/scripts/lib/pr-preview.test.mjs .github/scripts/visual-gate/workflow-concurrency.test.mjs
• pnpm exec actionlint -ignore 'label "2-core-ubuntu-arm" is unknown' .github/workflows/pr-comment.yml
• pnpm check:repo
• git diff --check

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
astryx	Ready	Preview	Aug 31, 2026 3:40am

[github-actions]

PR Analysis Report

Preview availability: Storybook and Sandbox were not published for this CI run.

No new or modified components detected.

Bundle Size Summary

No component packages changed.

Accessibility Audit

Status: No accessibility violations detected.

---

_{Generated by PR Enrichment workflow | View full report}

[cixzhang]

Semantic verdict: approve once undrafted.

🟢 No review blockers found — this preserves the default-branch trust boundary while letting old, already-trusted pr-meta.json artifacts render again. Triage: CI bug fix · non-breaking · trust-sensitive workflow path → full path · checks: exact workflow-run identity, legacy metadata compatibility, exact-field enforcement, mismatch rejection, deployment-proof preservation, actionlint, focused tests, and CI.

I checked exact head bd6aced7fa963d67957c16417c105c4dfaf6dbf3: the #5671 artifact has the old shape (prNumber, shortHash, storybookUrl, sandboxUrl, runId, runUrl) and is accepted only for the exact trusted PR/run/head-prefix identity. Wrong PR, wrong run, wrong head prefix, missing short hash, and mismatched exact identity fields all still reject; deployment proof validation is unchanged. CI is green. Full evidence: https://github.com/cixzhang/astryx/wiki/Review-5740

Because this PR is still draft and self-authored, GitHub may not accept a formal approval event; this is the semantic approval for the reviewed head.

[Reviewed by Agentcloud]