fix(mcp): prefer definitions and report ambiguity in name resolution #29

	# PR validation: security gates + lint + full test suite. Builds, smoke and
	# soak stay maintainer-driven via the dry-run workflow_dispatch. Branch
	# protection requires `dco` + `ci-ok` — a single stable summary context that
	# fails unless every PR stage succeeded.
	name: PR

	on:
	pull_request:
	branches: [main]

	permissions:
	contents: read

	# A new push to the PR supersedes the running validation — cancel it
	# instead of stacking zombie pipelines.
	concurrency:
	group: pr-${{ github.event.pull_request.number }}
	cancel-in-progress: true


	jobs:
	security:
	uses: ./.github/workflows/_security.yml
	secrets: inherit

	lint:
	uses: ./.github/workflows/_lint.yml

	test:
	needs: [lint]
	if: ${{ !cancelled() && needs.lint.result == 'success' }}
	uses: ./.github/workflows/_test.yml
	with:
	# Perf assertions are timing-sensitive on shared runners; they stay in
	# dry runs and releases where a flaky red does not block a merge.
	skip_perf: true

	ci-ok:
	# The one required context (besides dco) — fails unless every PR stage
	# succeeded, so matrix renames can never silently deadlock merges.
	needs: [security, lint, test]
	if: ${{ always() }}
	runs-on: ubuntu-latest
	timeout-minutes: 5
	steps:
	- name: All PR stages must have succeeded
	env:
	RESULTS: ${{ toJSON(needs) }}
	run: \|
	echo "$RESULTS" \| python3 -c "
	import json, sys
	needs = json.load(sys.stdin)
	bad = {k: v['result'] for k, v in needs.items() if v['result'] != 'success'}
	if bad:
	print('CI NOT OK:', bad)
	sys.exit(1)
	print('CI OK:', ', '.join(needs))
	"

Provide feedback