Wire per-PR evals into GitHub Actions, pick thresholds that survive flakiness, and decide when a gate belongs on main.