ci(migration): close the tracking issue only on the default branch (#1145)

`Close issue on success` fired on any green run, from any ref. So a
`workflow_dispatch` on a branch closed the issue that tracks a bug still present
on `main`.

Observed, not hypothesised: run #116 failed and opened #1143; run #117 was
dispatched on `fix/issue-1143-playground-reply-stream-race`, passed, and closed
#1143 at 17:29:23 — while the fix was unmerged and `main` still carried the racy
assertion. Nothing in the tracker recorded that the closure came from a branch.

What makes this worse than untidy: dispatching on a branch is the recommended
way to prove changes to this workflow — #1139, #1141 and #1143 could only be
proven that way. The practice that produces the best evidence was also the one
that silently wrote to the tracker.

Both jobs (`migration-test`, `migration-test-compose`) now guard the close with
`github.ref == 'refs/heads/main'`. Scheduled runs are unaffected: they run on the
default branch, verified against run 30530547302 (`event=schedule`,
`head_branch=main`).

The failure path is deliberately NOT scoped. A red branch run is worth filing —
that is exactly how #1143 was found. Instead both failure bodies now name the
ref and the event, so a reader can tell a branch experiment from a `main`
failure rather than assuming the latter.

Same family as #1120, #1141 and #1143: one signal read as proof of a different
claim.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Rafael

.github/workflows/migration-test.yml

@@ -299,8 +299,16 @@ jobs:
             /tmp/latest-digest.txt
             /tmp/nightly-digest.txt
 
+      # Scoped to the default branch (#1145). This step used to fire on ANY green
+      # run, so a `workflow_dispatch` on a branch closed the issue that tracks a bug
+      # still present on `main`. It happened for real: run #117, dispatched on the
+      # #1143 fix branch, closed #1143 while the fix was still unmerged and `main`
+      # still carried the racy assertion. Dispatching on a branch is the recommended
+      # way to prove changes to this workflow — #1139, #1141 and #1143 could only be
+      # proven that way — so the practice that produces the best evidence must not
+      # silently write to the tracker.
       - name: Close issue on success
-        if: success()
+        if: success() && github.ref == 'refs/heads/main'
         uses: actions/github-script@v9
         with:
           script: |
@@ -332,6 +340,10 @@ jobs:
               });
             }
 
+      # Deliberately NOT scoped to the default branch (#1145): a red branch run is
+      # worth filing — that is exactly how #1143 was found, by dispatching on a
+      # branch. The body names the ref and the event instead, so a reader can tell a
+      # branch experiment from a `main` failure rather than assuming the latter.
       - name: Create or update issue on failure
         if: failure()
         uses: actions/github-script@v9
@@ -355,6 +367,8 @@ jobs:
             const body = [
               `## Run #${context.runNumber} — ${new Date().toISOString().split('T')[0]}`,
               '',
+              `**Ref:** \`${context.ref}\` · **Event:** \`${context.eventName}\``,
+              '',
               report,
               '',
               `[Workflow Run](${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId})`,
@@ -743,8 +757,9 @@ jobs:
             /tmp/run-target.json
           retention-days: 30
 
+      # Same default-branch scope as the API job above (#1145).
       - name: Close issue on success
-        if: success()
+        if: success() && github.ref == 'refs/heads/main'
         uses: actions/github-script@v9
         with:
           script: |
@@ -790,6 +805,8 @@ jobs:
             const body = [
               `## Run #${context.runNumber} — ${new Date().toISOString().split('T')[0]}`,
               '',
+              `**Ref:** \`${context.ref}\` · **Event:** \`${context.eventName}\``,
+              '',
               `docker-compose migration test failed. Source: \`langflowai/langflow:latest\` → Target: \`langflowai/langflow-nightly:latest\`.`,
               `Compose file: pinned to upstream main of \`langflow-ai/langflow/docker_example/docker-compose.yml\`.`,
               '',