[kvlonge]

Why

main is moving to a merge queue: exact-count gates break when two pull requests merge on green runs against an outdated main. The queue only merges once every required check (Verify, Pull Request Metadata, Block automatic 1.0 releases) reports on the merge_group event, so each workflow behind them needs that trigger first.

Changes

• verify.yml: runs on merge_group. The classifier scopes from the group's base_sha...head_sha, which covers every queued pull request in the group. A missing SHA or failed diff runs every suite instead of skipping. Concurrency keys on the queue ref and never cancels merge-group runs. The same-runner ratio compares against the group base.
• pull-request-metadata.yml: runs on merge_group and succeeds, since the queue only admits pull requests whose metadata check passed. It runs rather than skips so the required check always reports.
• version-guard.yml: runs on merge_group against the group head, so the version that would land on main is the one checked.
• Run names fall back to the merge group's head commit message.
• Unchanged: compiler-differential, scope-performance, release-performance, website and publish report no required check. Release Please is unchanged: its PR still gets trusted statuses and auto-merge from the delivery app, then enters the queue and runs the same merge_group checks.

No test expectations or thresholds change.

Verification

• actionlint 1.7.7 on the three workflows
• Ran the classifier locally for simulated merge_group events (code diff, docs-only diff, missing and unknown base SHA), plus pull_request and workflow_dispatch: scopes match the PR path, and diff failures run every suite
• make check-ci, hygiene scan