CI: reconcile branch-protection required-check pins with emitted check names (estate-wide) #650

Background

Four required checks sat permanently at "Expected — Waiting for status to be reported" on this repo (the push to #645 confirmed it server-side: "4 of 4 required status checks are expected"). "Expected" is not a failure — it means a pinned context name was never reported on the head commit. Root cause: branch protection pins context strings the repo only conditionally emits. Three independent mechanisms produce the same symptom:

What's already done (repo-side)

• ci: make the four required status checks reportable on every PR #645 (merged): de-gated codeql.yml + hypatia-scan.yml; added a local-reusable bridge that re-emits governance / Validate Hypatia baseline. All four now report green.
• Sibling de-gate PRs: ci: de-gate required-check workflows to run on every PR base hypatia#518, ci: de-gate required-check workflows to run on every PR base gitbot-fleet#308, hyperpolymath/.git-private-farm#83.

What remains (needs repo-admin / branch-protection access)

1. Repoint the affinescript governance pin governance / Validate Hypatia baseline → governance (the name the standalone gate actually emits). Once repointed, the local bridge added in ci: make the four required status checks reportable on every PR #645 (governance-baseline.yml + governance-baseline-impl.yml) can be removed — it exists only to satisfy the stale pin without admin access.
2. Audit each repo's required-pin list vs. emitted names. Only affinescript is API-confirmed (the "4 of 4"); hypatia / gitbot-fleet / .git-private-farm need a required-vs-emitted diff against a green main PR.
3. Adopt the guardrail: a context may be marked Required only if it is emitted unconditionally on every PR that can target the protected branch. Pin to job names the repo's own workflows emit unconditionally — never to reusable-job names that can change out from under you, nor to app checks (see ci: Bump actions/cache from 5.0.2 to 5.0.4 #4).
4. The Hypatia app check — tracked separately in hyperpolymath/hypatia (post on every PR or de-require).

Acceptance

• affinescript governance pin repointed; ci: make the four required status checks reportable on every PR #645 bridge removed
• required-vs-emitted diff recorded for all four repos
• no required pin references a context that isn't always emitted
• guardrail documented (see docs/ci/required-checks.adoc)