If a forced push is done on a target repo/branch where pushes are usually done exclusively by CI, various bad things can happen:

• a change which is STAGED would, at the very least, need to be re-cherry-picked internally (staging rebuild). It's possible this already works, needs to be checked.
• a change which is INTEGRATING would remain in that state until the build completes, then the staging-approve command run by CI would fail (since the target branch -> build is not a fast-forward, which it must be).

To solve the problem for INTEGRATING changes, we can have the integrator monitor the target branch for updates from sources other than CI. If a non-CI update occurs, it can fail the build with a comment explaining that it was terminated due to a force push. The monitoring could be done by simple polling, or by gerrit stream-events.