Phase 3 (Q5+Q6): min-bump-to-engage policy + grouped-PR supersession

[petemoore]

Phase 3 sub-items Q5 and Q6 (docs/WORKPLAN.md). Self-contained pre-analysis steps, independent of the analyser-removal rework (see docs/questions.md sequencing note).

Q5 — per-repo min-bump-to-engage (default major)

Replaces the hardcoded "skip only patch." A PR is skipped out of policy when its bump ranks below the threshold, using a new models.BumpRank (major > minor > patch > unknown).

• Because unknown ranks lowest, the default major also skips unparseable-title PRs — this closes the Phase-0 finding that a non-bump PR from the trusted author currently reaches the (expensive) agent. (Validates the Q14 author-filter-only safety.)
• Grouped PRs are ranked by their highest member bump (maxGroupedBump), so a group engages iff that max meets the threshold (an all-patch group is now correctly skipped under major).
• The skip + reason are recorded on the dashboard. The CLI action ActionSkippedPatch → ActionSkippedPolicy ("SKIPPED (policy)").
• New --min-bump-to-engage flag + MinBumpToEngage config (validated to major|minor|patch; unknown rejected as a threshold).

Q6 — grouped-PR supersession

FindSupersedingGroup decomposes open grouped PRs into member (package, version) pairs and closes an individual PR when a group already covers its package at ≥ its version.

Asymmetric by design (Q6 → a):

• group covers P at ≥ individual's version → close the individual ("superseded by group #N");
• individual's version > group's for P → keep the individual, do not close the group;
• equal version → the group wins.

A group is never closed as stale (it bumps its other members too). Kills the duplicate-work / duplicate-replacement-PR path. Package match is exact string equality, mirroring FindNewerPRForPackage (a known caveat where group-table names and individual package names differ in formatting).

Tests

• TestBumpRank — ordering, unknown lowest, unrecognised == unknown.
• TestBelowMinBump — the engage decision across thresholds, incl. unknown → skip.
• TestFindSupersedingGroup — ≥ rule, lower-version-kept, asymmetry (a group is never superseded), non-semver guards, highest-version-wins, individual-ahead-kept.
• TestValidateMinBumpToEngage — config validation.

Local: go build/vet/test ./..., gofmt, staticcheck all clean.

🤖 Generated with Claude Code