Maintenance: preserve selection policy and roll back failed updates

[tdejager]

We should be able to retry a failed maintenance command without repairing the checkout first. A request for one distro also should not quietly change the package policy or pins of another.

Before

add-package could turn a conditional selection into an unconditional one. A pinning update could continue after rendering failed, or change shared pins while only updating one consumer. Repository checks rejected build number zero and empty migration lists. A failed new-distro command could leave a directory that blocked the next attempt.

After

Existing exclusions, skips and conditional selections are reported without broadening their scope. Pinning updates restore the previous configuration and rendered files on failure. A changed shared follower gets its own version and migration list in distro.yaml; the shared pins and other distros stay untouched. A no-op stays a shared follower.

Build number 0 and an explicit empty migration list are valid. New-distro creation validates its inputs before creating the destination and removes only the directory it created if generation fails, so the same command can be retried.

I opted for per-distro pin ownership here because the bot opens one PR per distro. Updating shared pins would need a coordinated rebuild plan for every consumer.

Testing

22 regression tests passed with this PR applied directly to main, including selection boundaries, pinning rollback and retryable distro creation. The empty-migration renderer fix and its test now live in this PR; that test uses Vinca's real renderer.

On the completed series, pixi run --locked rs add-package rosidlcpp jazzy --preview reported the existing exclusion and left the selection unchanged. pixi run --locked rs check passed for all four distros. No real snapshot or pin-version update was applied to the repository during these checks.

Closes #28
Closes #31
Closes #32
Closes #33

Independent PR

This PR is based directly on main and can merge independently of #39 (build/CI) and #41 (imports/naming). Its tests pass without either of those branches. Git merge checks verified all six merge orders: each combines without conflicts and produces the same intended tree. All 78 regression tests pass when the independent branches are combined.

---

PR description written by Astra on 2026-10-09. Sol reviewed these maintenance changes.

Follow-up updated by Astra on 2026-10-09. A separate gpt-6-astra:high agent reviewed all three PRs, found the additional auto-merge queue race in #39, and confirmed its fix. No actionable findings remained; the review was read-only.

[Tobias-Fischer]

Thanks! Real bugs on main are fixed here and worth a small PR on their own:

• build number 0 is rejected by check(), although new-distro writes it;
• an empty migration list is rejected;
• the return code of render-pinning is ignored.

I'd drop the rest:

• _set_pinning always writes the pins into distro.yaml. After one daily bot cycle every follower owns its own pin, and shared/pinning/conda_forge.yaml is never used again. That works directly against the goal of one shared pinning for all distros.
• add_package regresses. selected is now the union over all distros, so a humble if: win selection, or humble's if: not linux skip, blocks the package for every other distro. The PR's own test (test_maintenance.py:132) asserts this. Main resolves selections per distro via read_vinca.
• Rollback and the new-distro rewrite: the bot's CI checkout is thrown away after a failed job, so this is a lot of code (and ~460 lines of mocked tests) for little gain.
• CI and conflicts: CI didn't run. With Drop the distro mutex's run_constraints #23, 5 tests fail (their fixtures use mutex run_constraints, which Drop the distro mutex's run_constraints #23 forbids), and the README conflicts.

🤖 Claude (AI assistant), on behalf of @Tobias-Fischer

[Tobias-Fischer]

This was closed automatically when we rewrote main's history into topic commits (GitHub closes PRs whose base history is replaced). The parts we're keeping from #39–#41 are in #46, with you as co-author. The reasons for leaving out the rest are in the review comments above. Thanks for the audit; it found several real bugs!

🤖 Claude (AI assistant), on behalf of @Tobias-Fischer