feat(workflow-guard): check mid-merge in gitea_resolve_task_capability

gitea_mcp_server.py

@@ -4280,6 +4280,31 @@ def gitea_resolve_task_capability(
     required_permission = TASK_MAP[task]["permission"]
     required_role = TASK_MAP[task]["role"]
 
+    if required_role == "reviewer" and role_session_router.check_mid_merge():
+        profile = get_profile()
+        h = host or (REMOTES.get(remote, {}).get("host") if remote in REMOTES else None)
+        username = _authenticated_username(h) if h else None
+        next_safe_action = (
+            "infra_stop: Unresolved merge conflict or mid-merge state detected in MCP runtime source. "
+            "Please resolve all conflicts manually, finish/abort the merge, restart the MCP server, and retry."
+        )
+        return {
+            "requested_task": task,
+            "required_operation_permission": required_permission,
+            "required_role_kind": required_role,
+            "active_profile": profile["profile_name"],
+            "active_identity": username,
+            "active_profile_allowed_operations": profile.get("allowed_operations") or [],
+            "allowed_in_current_session": False,
+            "stop_required": True,
+            "infra_stop": True,
+            "task_role_guidance": [next_safe_action],
+            "matching_configured_profile": [],
+            "runtime_switching_supported": gitea_config.is_runtime_switching_enabled(),
+            "different_mcp_namespace_required": False,
+            "exact_safe_next_action": next_safe_action,
+        }
+
     record_preflight_check("capability", required_role)
 
     profile = get_profile()