feat(automation): run Inkspan hourly NVIDIA NIM review repair - #796

Purpose

Add the product-specific one-hour PR review → repair → revalidation caller for ContextualWisdomLab/inkspan while reusing the bounded NVIDIA NIM scheduler from prerequisite PR #782.

Exact current stacked head

a4af64e6866c591eecbaa63a0e22e4145c1a257e

The branch now contains a real merge parent for current prerequisite head b921e26854f1b0fd367c76a32af6db966374bcef; GitHub reports the stacked PR mergeable with exactly five product files. No force-push, temporary workflow, encoded patch, or competing branch writer was used.

Product and MSA behavior

• Run .github/workflows/inkspan-hourly-review-repair.yml at minute 37 of every hour, offset from Clearfolio.
• Target exact repository ContextualWisdomLab/inkspan and protected base main.
• Permit at most one repair dispatch per invocation and one retry per exact head per hour.
• Keep an Inkspan-specific single-flight concurrency group so product runs cannot cancel Clearfolio runs.
• Call the product-neutral central scheduler rather than copying privileged implementation into Inkspan.
• Preserve standalone Inkspan operation and naruon compose / ui.panel modular integration.

Credential, privacy, and compliance boundary

• The caller maps only PR_REVIEW_MERGE_TOKEN and OPENCODE_APPROVE_TOKEN; it never uses secrets: inherit.
• COPILOT_GITHUB_TOKEN, GitHub Models, and direct NVIDIA_NIM_API_KEY binding are absent from the caller.
• The caller and reusable scheduler keep the workflow-generated GITHUB_TOKEN read-only and declare no job-level write elevation.
• Cross-repository operations use only the explicit scheduler credentials, with no github.token mutation fallback.
• The caller contains product/branch identity and bounded numeric limits, not business payloads, comment bodies, model output, or personal records. Separation and minimization preserve operational identifiers without masking them.
• The repair plane cannot approve, merge, release, alter reviewer credentials, update branch protection, or convert a failed check into success.

Permanent five-file slice

• .github/workflows/hourly-nvidia-nim-review-repair.yml
• .github/workflows/inkspan-hourly-review-repair.yml
• CHANGELOG.md
• docs/doctoring/inkspan-hourly-review-caller.md
• tests/test_pr_review_fix_hourly_contract.py

The focused workflow tracks both the caller and doctoring. The static contract validates the exact schedule/target, independent concurrency, one-dispatch and one-hour bounds, explicit secret mapping, read-only workflow-token boundary, no inherited or model secrets, and absence of product literals from the reusable engine.

Stacked activation boundary

This PR targets fix/hourly-nvidia-nim-review-repair-main, the head branch of prerequisite #782. It must not merge before #782. The schedule is inactive until both the prerequisite and this caller reach protected main.

After #782 merges:

1. retarget this PR to main;
2. verify the effective diff remains the exact five-file product slice;
3. rerun every exact-head focused/full quality, 100% production statement/branch/docstring, security, supply-chain, CodeRabbit, OpenCode, Noema, independent-approval, unresolved-thread, and branch-protection gate;
4. merge only without administrative bypass.

Keep Draft. Pending, queued, cancelled, skipped-required, status-only, author-only, predecessor-head, or synthetic evidence is not acceptance.