Address review: the ratchet no longer replaces an open tightening PR's
branch that carries commits it did not make, and pushes with explicit
leases on the tip it checked. The PAT-bearing job pins its actions to
commit SHAs. The docs say dispatch needs the file on master first.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>