feat(pr-fix): structured WAITING_EXTERNAL dependencies and fail-closed holds #1250

Grooming update (2026-10-15): P1 / READY. The design dependency #1248 is merged. This is the first independent Dispatch PR-fix fix to implement: stop new no patch/unverifiable results from creating fake six-hour external waits. Keep legitimate dependency waits and historical records safe; do not wait for #1249 or build #1253's reconciliation here.

Why

A WAITING_EXTERNAL status currently accepts a free-text note plus a cooldown. A missing patch or unverified feedback is not a concrete external dependency. This is an implementation child of #1244 / design PR #1248.

Work

• Define and persist the bounded, typed external-wait contract: dependency kind/ref, observed unsatisfied evidence, recovery trigger, and recheck deadline. Validate at markPrFixItem, the worker tasks/report path, and any other WAITING_EXTERNAL writer.
• Require a named, independently verifiable dependency for new waits. A dependency-less wait/no-change report becomes a fail-closed operational PARKED disposition with an audited reason, not a six-hour fake wait or a human BLOCKED decision.
• Keep existing-generation report/mark idempotency and cooldown; reject a stale generation and any attempt to reset the deadline with duplicate marks.
• Treat preexisting free-text waits as legacy/unknown and surface them for operator action; no automatic bulk downgrade, requeue, or expired-wait rewrite. Expose a read-only trigger evaluation contract so a later recovery worker can decide when a dependency resolves.
• Keep issuer/worker agnostic and use the existing forge/service read capability; no Courier-specific phase or token.

Acceptance

• Structured upstream-PR, CI-check and external-service examples validate and recheck; an unverifiable dependency stays unknown/held, never silently ready.
• New no-patch/no-dependency wait parks fail closed, with audit provenance; legacy records remain untouched and visible.
• Duplicate/late worker reports do not prolong the wait or clobber a new generation; merged/closed PRs and explicit human holds never reactivate.
• Tests cover every writer, admission/settlement races and bounded schema validation.

Dependencies

Blocked until #1248's WAITING_EXTERNAL semantics are accepted. Fresh-feedback reactivation belongs to a separate implementation issue. No new cooldown/attempt defaults.