Merge remote-tracking branch 'origin/main' into claude/fix-cross-repo-closer-require

# Conflicts:
#	.github/workflows/cross-repo-issue-closer.yml

Author: claude

.changeset/fix-cross-repo-closer-octokit.md

@@ -0,0 +1,23 @@
+---
+---
+
+fix(ci): rename the cross-repo client — `github-script` already declares `octokit`
+
+Release-nothing: touches `.github/workflows/cross-repo-issue-closer.yml` only.
+
+`actions/github-script` injects an `octokit` binding into the script scope, so
+the `const octokit = require('@actions/github').getOctokit(token)` added in
+#4553 aborted the run before a single line of logic executed:
+
+    SyntaxError: Identifier 'octokit' has already been declared
+
+This surfaced on #4553's own merge — the first time the workflow ever ran, and
+the first time any of its runtime behaviour was exercised. Until this lands,
+every merged pull request in this repository carries one red check.
+
+The pre-merge validation missed it for an instructive reason. The script was
+syntax-checked against a hand-written wrapper declaring `{github, context,
+core, require}` — and a wrapper that omits an injected identifier cannot
+possibly see a collision with it. The check reported clean because it was
+asking a narrower question than the runtime asks. The wrapper now carries the
+full injected set, and the previous spelling fails it.

.github/workflows/cross-repo-issue-closer.yml

@@ -67,6 +67,10 @@ jobs:
             );
 
             // Report credential state on EVERY run, before any early return.
+            // Otherwise a repository with the secret and one without look
+            // identical until a cross-repo reference happens to show up —
+            // which can be days — and "is it configured?" stays unanswerable.
+            // Presence only; the value is never read into the log.
             const token = process.env.CROSS_REPO_TOKEN;
             core.info(
               `CROSS_REPO_ISSUE_TOKEN: ${token ? 'configured' : 'ABSENT — cross-repo closes will be reported, not performed'}`,