chore: python cron fix [DO NOT MERGE YET]

[caroger]

Summary

• harden Python canary auto-fix Slack notifications by moving PR notification into a separate downstream job
• resolve PRs by branch, run ID, or the most recently updated Claude canary PR, including closed or reused PRs
• normalize timeout messaging when Claude reports success before GitHub marks the job cancelled
• require local pinned and -latest tox verification before auto-fix opens or updates a PR
• upgrade GitHub Action pins used here to Node 24-safe versions

Validation

• exercised the timeout/notifier path with runs 24369944541 and 24371429007
• latest run confirmed the downstream notifier still executes after auto-fix times out
• underlying Claude auto-fix hang is still unresolved

Manual test

gh workflow run python-cron.yaml --ref test-python-cron-slack
RUN_ID=$(gh run list --workflow "Python Canary Cron" --branch test-python-cron-slack --event workflow_dispatch --limit 1 --json databaseId --jq '.[0].databaseId')
gh run watch "$RUN_ID"

Check the jobs we care about:

gh run view "$RUN_ID" --json jobs \
  --jq '.jobs[] | select(.name=="Propose fix for failures" or .name=="Slack auto-fix PR notification" or .name=="Slack notification") | {name,status,conclusion,url}'

If auto-fix times out, inspect the logs:

AUTO_FIX_JOB=$(gh run view "$RUN_ID" --json jobs --jq '.jobs[] | select(.name=="Propose fix for failures") | .databaseId')
PR_NOTIFY_JOB=$(gh run view "$RUN_ID" --json jobs --jq '.jobs[] | select(.name=="Slack auto-fix PR notification") | .databaseId')

gh run view "$RUN_ID" --job "$AUTO_FIX_JOB" --log | rg '"type": "result"|"subtype": "success"|The operation was canceled'
gh run view "$RUN_ID" --job "$PR_NOTIFY_JOB" --log | rg 'Auto-fix|Claude reported|no PR was found|Send message to Slack'

[github-actions]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

[github-actions]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.