Release 2.1.137 (2026-07-14)

Bug fixes

• force GET on the actions/runs harvest query (#2335) (#2336) select_ci_run passed the head_sha filter as a -f head_sha= field. gh api switches to POST the instant any -f/-F field is present, and GET /actions/runs is GET-only, so the call returned HTTP 404. As the first network call in run_harvest, it silently sank the entire evidence gate and bundle — every warning-mode release baked a zero.

Move the head_sha filter into the endpoint URL query string so the call stays a GET. Audited every other gh api call in the harvest path; all the rest were already field-free GETs, so this was the sole offender.

Add a call-shape test that asserts the constructed gh argument list issues a GET (no -f/-F field unless paired with an explicit -X GET) with the filter carried in the URL, closing the gap where the prior tests mocked read_json and never exercised the GET-vs-POST behavior.

This is the first bake finding for the CI-evidence bundle; further downstream integration bugs may surface as the harvest now proceeds past this point.