fix(ci): the required SET is readable — retire the 403 premise and diff the live ruleset (#9679)

`check-required-contexts.mjs` reasoned from "no agent seat can read the
ruleset", citing a 403 from
`GET /repos/objectstack-ai/objectstack/branches/main/protection`. That is the
CLASSIC branch-protection endpoint — GitHub prices it at
`administration=read` (its own `X-Accepted-GitHub-Permissions` header), which
is not among the 17 permissions a workflow may grant a `GITHUB_TOKEN` — and it
is not where this repository's configuration lives. `main` is governed by a
repository RULESET, and the ruleset endpoints answer 200 from an ordinary
agent seat at `metadata=read`.

- Corrects the premise in all three sites the card names (the script header,
  the failure prescription, the lint.yml step comment) and a fourth the sweep
  found (`check-partof-closing-keyword.mjs`), naming BOTH endpoints and which
  one this repo uses so the next reader cannot test the wrong URL and conclude
  the comment is wrong.
- Adds `--verify-required-set`: reads every ruleset that applies to the repo
  (including inherited org rulesets), and diffs the live required set against
  REQUIRED_CONTEXTS in BOTH directions — a registry row that is not required
  (the family is advisory today, #5617's unsignalled half) and a required
  context no row pins (a rename detaches it silently).
- Report-only, and OFF the required path by construction: the settings half of
  any required-set change is maintainer-only and lands AFTER the merge, so a
  merge-blocking version would be red on the very PR carrying the repo half.
  Posture is `check-governed-merges.mjs`'s — a completed sweep exits 0 whether
  it found 0 or 40 disagreements; a non-zero exit classifies the ENVIRONMENT,
  and unreachable prints NOT VERIFIED, never a pass (#4690).
- The self-test (offline) covers both directions, `evaluate`-mode rulesets,
  ref-scope, the unprotected reading, the NOT-VERIFIED renderer, and pins that
  the pin stays network-free and that nothing wires the live read into a job
  publishing a required context.


Claude-Session: https://claude.ai/code/session_01XqDQYVU5smx29ts9pAErja

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]

.github/workflows/lint.yml

@@ -908,9 +908,14 @@ jobs:
       # the machine-readable form of #5617's audit exclusions. It deliberately
       # does NOT judge job-level `if:`: four of the enrolled ci.yml jobs carry a
       # filter-driven `if:` by design (#4928), and a skipped job still publishes
-      # a context. ⚠️ It cannot verify the required SET itself — Settings →
-      # Rulesets is unreadable from every agent seat (403) — so it asserts the
-      # repo-side half only, and the script's header says so at length.
+      # a context. ⚠️ It does not read the required SET itself — but not because
+      # it cannot: the rulesets API answers 200 to an ordinary seat (it is the
+      # CLASSIC branches/main/protection endpoint that answers 403, and this repo
+      # does not use classic branch protection — #9642). The live diff is a
+      # separate report-only mode, `--verify-required-set`, deliberately kept OFF
+      # this required path: the settings half of a rename is maintainer-only and
+      # lands after the merge, so a blocking version would be red on the very PR
+      # carrying the repo half. This step stays network-free.
       # Reads two YAML files; sub-second.
       - name: Required-context name pin
         run: pnpm check:required-contexts

scripts/check-partof-closing-keyword.mjs

@@ -98,8 +98,13 @@
  *
  * It also does not decide branch protection. This publishes a red check run;
  * whether that check run becomes a REQUIRED context is a settings change no
- * agent seat can make (the protection endpoint answers 403 here) and, per the
- * required-context registry convention, one that carries a maintainer ruling.
+ * agent seat can make — the seat reads the repository as a non-admin
+ * (permissions.admin false) — and, per the required-context registry
+ * convention, one that carries a maintainer ruling. ⚠️ Not-writable is the
+ * claim here, and only that: the required set is READABLE from an ordinary
+ * seat (the rulesets API answers 200; it is the classic branch-protection
+ * endpoint that answers 403, and this repo does not use classic branch
+ * protection — #9642, which retired that conflation elsewhere in this tree).
  * The duplicate-fix guard sits in exactly the same position.
  *
  * ## Why the paths above are unquoted