[ci-scan-feedback] harden fixer self-dedup with a non-integrity-gated branch-list backstop

Read .github/workflows/ci-failure-fix.md around lines 166, 253, and 263, starting with the existing deduplication checks and branch-list handling. Update the checks so matching ci-fix branches remain authoritative when PR search results are filtered, and require the documented branch-token format. Done means the fixer skips an existing KBE branch even when the PR map is unavailable.

Triggering signals

• (#131981, MEMBER kotlarmilos: "Duplicate https://github.com/dotnet/runtime/pull/131515." — a [ci-fix] help PR that duplicated the fixer's own earlier PR #131515; both live on ci-fix/131382-... branches and both link KBE #131382, https://github.com/dotnet/runtime/pull/131981)
• (rubric finding: list_branches on dotnet/runtime shows two ci-fix/131382-helix-pythonpath-windowsshell-* branches, plus ci-fix/android-x509-...-128890-... and ci-fix/reflection-unwrap-tie-128766-... where the KBE id is mid-name, not a prefix — so Step 3's ci-fix/<kbe>- prefix key never matched them)
• (rubric finding: github MCP search_pull_requests/search_issues for [ci-scan]/[ci-fix] artifacts returns [Filtered] under the integrity gate — 71 [ci-scan] items filtered this tick — silently emptying the dedup PR map, while list_branches returns unfiltered results)

Proposed edits

• (.github/workflows/ci-failure-fix.md:166 — add a non-integrity-gated list_branches dedup backstop with a position-independent (^|-)ci-fix/(.*-)?<kbe>(-|$) token match; directly closes the gap that let #131981 duplicate #131515)
• (.github/workflows/ci-failure-fix.md:166 — update dedup check 1 to treat either a PR-map hit or a matching branch as authoritative, even when the PR search is [Filtered])
• (.github/workflows/ci-failure-fix.md:253,263 — require the numeric KBE id to be the first hyphen-delimited branch token in Steps 5.3/5.4 so the branch-list key is reliable going forward)

Expected behavior change

On the next fixer run, before opening a [ci-fix] PR the agent enumerates repository branches (which the integrity gate does not filter) and skips any KBE that already has a ci-fix/...<kbe>... branch, regardless of where the id sits in the name. This prevents the recurring failure mode where an integrity-[Filtered] PR search hid the fixer's own prior PR and it opened a duplicate for the same KBE (#131981 vs #131515).

[!NOTE]
This PR description was generated by an AI agent (GitHub Copilot).

Generated by CI Outer-Loop Failure Scanner — Feedback · opus48 · 541.6 AIC · ⌖ 26.5 AIC · ⊞ 20.6K · ◷

[!NOTE]
This was originally intended as a pull request, but the git push operation failed.

Original error: The process '/usr/bin/git' failed with exit code 1

Workflow Run: View run details and download bundle artifact

The bundle file is available in the agent artifact in the workflow run linked above.

To create a pull request with the changes:

# Download the artifact from the workflow run
gh run download 33312726322 -n agent -D /tmp/agent-33312726322

# Fetch the bundle into a temporary ref, then update the local branch
git fetch /tmp/agent-33312726322/aw-ci-scan-feedback-dedup-branchlist.bundle refs/heads/ci-scan-feedback-dedup-branchlist:refs/bundles/create-pr-ci-scan-feedback-dedup-branchlist-ff21e57fce465c60-95c03704
git update-ref refs/heads/ci-scan-feedback-dedup-branchlist-ff21e57fce465c60 refs/bundles/create-pr-ci-scan-feedback-dedup-branchlist-ff21e57fce465c60-95c03704
git checkout ci-scan-feedback-dedup-branchlist-ff21e57fce465c60
# Ensure the working tree matches the updated branch
git reset --hard
# Remove the temporary bundle ref
git update-ref -d refs/bundles/create-pr-ci-scan-feedback-dedup-branchlist-ff21e57fce465c60-95c03704

# Push the branch to origin
git push origin ci-scan-feedback-dedup-branchlist-ff21e57fce465c60

# Create the pull request
gh pr create --title '[ci-scan-feedback] harden fixer self-dedup with a non-integrity-gated branch-list backstop' --base main --head ci-scan-feedback-dedup-branchlist-ff21e57fce465c60 --repo dotnet/runtime