feat(bump-callers): add linear-ticket caller-bump fleet

[claude]

Requested by Matt Miller · Slack thread

What

Adds the missing caller-bump fleet for linear-ticket.yml, mirroring the existing
bump-area-label-callers.yml fleet:

• .github/workflows/bump-linear-ticket-callers.yml (new) — watches
  linear-ticket.yml + scripts/linear-ticket/** (minus tests/ and README.md,
  which no pinned caller executes), runs the shared preflight.sh staleness/decommission
  guard, then fans SHA-bump PRs out via bump-callers.sh using a new roster secret
  LINEAR_TICKET_CALLERS.
• docs/callers/linear-ticket.md — adds the roster-enrollment paragraph (ask a
  maintainer to add your repo to LINEAR_TICKET_CALLERS; enrolment doesn't backfill your
  pin, so workflow_dispatch the new fleet once after being added).
• docs/callers/README.md — adds the missing linear-ticket.yml / LINEAR_TICKET_CALLERS
  row to the "Staying current" roster table.
• .github/bump-callers/README.md — fixes the fleet table, which was missing rows for
  both bump-area-label-callers.yml (pre-existing drift) and the new
  bump-linear-ticket-callers.yml.

Why

linear-ticket.yml already has two live callers — Comfy-Org/cloud and
Comfy-Org/comfy-infra, both via .github/workflows/linear-ticket-validate.yml — but no
fleet existed to keep their pins current. One of them is already a commit behind main
with no automatic way to catch up. Per this repo's own bump-callers README: "A reusable
that has callers but no fleet is the trap this whole directory exists to prevent."

Action needed after merge

This PR does not seed the roster secret (that's a maintainer action, not something an
agent should do). A maintainer needs to run:

echo '[{"repo": "Comfy-Org/cloud", "file": ".github/workflows/linear-ticket-validate.yml", "label": ""}, {"repo": "Comfy-Org/comfy-infra", "file": ".github/workflows/linear-ticket-validate.yml", "label": ""}]' \
  | jq -c . \
  | gh secret set LINEAR_TICKET_CALLERS --repo Comfy-Org/github-workflows

Then workflow_dispatch bump-linear-ticket-callers.yml once to backfill the two existing
callers' pins (landing the fleet itself doesn't touch linear-ticket.yml, so it fires no
run on its own).

Caveat: ALLOW_EMPTY is "false" for this fleet (two live callers already exist), which
only matters at push-triggered runtime against the live secret — not at PR-check time. It's
safe to merge this PR before the secret is seeded, as long as nobody merges a
linear-ticket.yml or scripts/linear-ticket/** change in the meantime (that would fire
the fleet against a still-empty/missing secret and hard-fail).

Also flagged (out of scope of this diff)

AREA_LABEL_CALLERS is a separate, pre-existing fleet (bump-area-label-callers.yml) that
still needs Comfy-Org/cloud and Comfy-Org/comfy-infra seeded into it if those repos also
run a pr-area-label.yml caller — worth a maintainer double-checking, but not something this
PR touches.

Validation

bash .github/bump-callers/tests/test_bump_callers.sh      # 424 passed, 0 failed
bash .github/bump-callers/tests/test_preflight.sh         # 278 passed, 0 failed
bash .github/bump-callers/tests/test_paths_contract.sh    # 66 passed, 0 failed (covers the new entrypoint)
python3 -m unittest discover -s .github/workflow-pins/tests -p 'test_*.py'   # 78 tests, OK
python3 .github/workflow-pins/check_workflow_pins.py       # OK — 10 workflows, none with a default workflows_ref

shellcheck was not available in the sandbox this PR was prepared in, so it was not run
locally — CI's test-bump-callers.yml will lint the new file.

---

Generated by Claude Code