The Effect review bot proposed PR #222 solely to remove a dependency suppression, without establishing a reachable bug. Require caller and lifecycle evidence, a concrete failure or measurable unnecessary work, preserved setup/cleanup ownership, and verification of the actual claim. Missing required checks now mean no PR; zero findings is explicitly successful.

Regenerated the workflow lock file. Schedule, permissions, and the five-PR limit are unchanged.

Also stabilizes the PostgreSQL job-lock lease regression: handle the expected rejection immediately, observe the actual lock wait, and wait for expiry using PostgreSQL’s clock.

Validation: workflow compilation; `bun run ci`, types, build, 1,729 unit tests, and all 59 PostgreSQL tests pass. The repaired lease test also passes 10 consecutive runs.

### Acceptance gates