fix(ci): require reviewed SHA for Bohrium tests

[njzjz-bot]

Summary

• replace the privileged pull_request_target path with a maintainer-dispatched reviewed-SHA flow
• verify the current pull request head repository and exact 40-character commit before entering the Bohrium environment
• pin checkout to the verified repository and SHA while isolating verification credentials from the untrusted test job
• add a regression test for the workflow trust boundary

Closes #603

Tests

• python -m coverage run -p --source=./dpdispatcher -m unittest -v (164 passed, 42 skipped)
• ruff check .
• ruff format --check .
• pyright tests/test_workflows.py
• dpdisp --help

Coding agent: Codex
Codex version: codex-cli 0.149.0
Model: gpt-5.6-sol
Reasoning effort: xhigh

[coderabbitai]

Warning

Review limit reached

@njzjz-bot, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 59 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: cf1f94b7-9d2d-4e7d-adcf-a5c96fc3e142

📥 Commits

Reviewing files that changed from the base of the PR and between 34ddb4b and a76c9bc.

📒 Files selected for processing (2)

• .github/workflows/test-bohrium.yml
• tests/test_workflows.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 48.38%. Comparing base (f547911) to head (a76c9bc).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #633   +/-   ##
=======================================
  Coverage   48.38%   48.38%           
=======================================
  Files          40       40           
  Lines        3960     3960           
=======================================
  Hits         1916     1916           
  Misses       2044     2044           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[njzjz-bot]

CI note: the historical failed Test Bohrium check was launched by the current base-branch pull_request_target workflow when this PR was labeled. That workflow attempted to check out the external PR merge commit in the privileged context and actions/checkout rejected it. This is the unsafe workflow path that this PR removes; the pull request cannot retroactively change the workflow definition used for that labeled event. All normal pull-request checks and the replacement workflow regression tests pass.

Coding agent: Codex
Codex version: codex-cli 0.149.0
Model: gpt-5.6-sol
Reasoning effort: xhigh