feat(competition): engine-lane auto-merge on dethrone, quarantined

[plind-junior]

removes the human from the engine-lane merge loop: a strategy submission that clears the dethrone band against the ladder branch now arms native auto-merge, same as the kit lane. the benchmark decides what enters contrib/.

the write path is deliberately split. the scoring job is unchanged - it executes the untrusted challenger under the sandbox and holds a read-only token plus the comment scope. a new arm job holds the write scopes, checks out nothing, runs no challenger code, and only turns the gate's verdict into gh pr merge --auto --squash, gated on the pr base being KOTH_LADDER_BASE. prs against main/test remain scored-and-commented only.

the containment contract is now stated explicitly in the workflow header and the vouch.strategy docstring, and each leg was verified in code: merged contrib strategies execute exclusively through the sandbox child (score_strategy.py wraps both arms in SandboxProxy, and so does vouch bench run --strategy/--against); the ledger and ratchet scripts are stdlib-only file rewriters that import nothing from the merged tree (promote_champion.py copies bytes); and promotion into src/vouch as trusted importable default code remains a human-reviewed pr - the benchmark is never the sole gate to code users install.

the accepted residual is documented rather than papered over: a sandbox escape during scoring can forge its own verdict and auto-merge its pr. what it lands in is the quarantine it already runs in - no write token, no secrets, no in-process import path. the sealed monthly run still settles payouts, so a gamed daily verdict buys a provisional throne, not money.

docs (koth-strategy-lane.md table + honest-boundary section) and the scorecard comment stop claiming engine code never auto-merges. verification: zizmor offline clean, ruff + mypy clean, strategy/bench tests green.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (2)

• test
• main

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a0765c8d-608a-488b-be82-49e7bf37dc34

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/engine-lane-automerge

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}