[no-ci] Improve the Pixi lockfile freshness check

[jpascucci-nv]

so PRs are not blamed for lockfile drift that already exists on their base commit.

Closes #2926

Description

For stale lockfiles in pull requests, the workflow now:

• runs the same pinned Pixi version against the PR candidate and base SHA;
• records the original and repaired lockfile blob hashes for both trees;
• classifies the failure as PR-induced, base maintenance, or mixed/ambiguous;
• provides category-specific remediation in annotations and the job summary;
• links to the open maintenance refresh PR when available, otherwise to the refresh workflow.

The aggregate check remains failing for every stale classification. Push and manual runs retain their existing strict behavior, while timeouts and other operational failures remain distinct from staleness.

A small Python helper contains the classification logic, with focused tests covering each outcome.

Testing

• 83 passed, 36 subtests passed for ci/tools/tests
• Ruff passes
• actionlint v1.7.12 passes
• git diff --check passes

Checklist

• New or existing tests cover these changes.
• The documentation is up to date with these changes.

[rwgk]

Approving based on a Codex gpt-6-sol (medium) review. Before merging, could you please add this small hardening patch?

diff --git a/.github/workflows/ci-pixi-lockfile-freshness-check.yml b/.github/workflows/ci-pixi-lockfile-freshness-check.yml
index c6e4269200c..00d14987999 100644
--- a/.github/workflows/ci-pixi-lockfile-freshness-check.yml
+++ b/.github/workflows/ci-pixi-lockfile-freshness-check.yml
@@ -82,9 +82,8 @@ jobs:
             gh pr list \
               --state open \
               --head ci/pixi-lock-refresh/all \
-              --limit 1 \
-              --json url \
-              --jq '.[0].url // ""'
+              --json url,isCrossRepository \
+              --jq '[.[] | select(.isCrossRepository == false)][0].url // ""'
           )" || lookup_status=$?
           if ((lookup_status != 0)); then
             echo "::warning::Could not look up the open Pixi lockfile refresh PR; using the refresh workflow link instead."

--head matches the branch name without checking which repository owns it. This selects only a refresh PR from this repository; if none matches, the existing workflow-link fallback applies. Removing --limit 1 also ensures a fork PR with the same branch name cannot hide the intended PR.

[rwgk]

I forgot to add:

I think there is no reason to run the full CI again: I'd add [no-ci] to the PR title before pushing the suggested small hardening patch.

[rwgk]

Thanks @jpascucci-nv!

[github-actions]

Doc Preview CI
Preview removed because the pull request was closed or merged.