feat(inventory): assert the selftests gate is REQUIRED, not merely present (backend#1680)

[LukasWodka]

Summary

selftests.yml was added to be a required status check — its own header says
so, and cites the org rule it turns on itself: a guard in a non-required job is
advice, not a gate (backend#1729). Nothing made it required.

So the eight suites guarding the reusables every other repo's CI depends on could
go red and block no merge, and the protection audit reported conformance without
ever looking at it. The workflow said "required"; the protection said nothing.

selftests is now armed on develop and staging, and this states it — so a
later removal is drift rather than silence.

Armed while green, and verified reporting first

• selftests.yml triggers on pull_request: with no branches: and no
  paths: filter, deliberately (its header explains why), so it reports on every
  PR. A required context that can never report leaves the PR waiting forever
  (client#665, pii-gate/pii-check).
• Green in all 4 runs since it landed, measured per job — including on the
  release-train/to-staging head of promotion PR release-train: develop -> staging #268.

Not armed on prod, deliberately

Sequencing, not a decision against it. selftests.yml reaches staging only when
the promotion carrying it merges, so until then a staging -> main PR head cannot
report the context. The comment on the cell carries the follow-up.

Type

feat(inventory)

Test plan

divergent is the only cell shape that can state a repo's own set. It diverges by
requiring more than the fleet baseline; the comparison in
evaluate_protection() is a subset test, so this strictly strengthens the
assertion — and arming alone could not have reddened the live audit.

• make selftests green.
• The new cell mutation-proved through the real evaluate_protection() against
  the live branches: renaming the armed context reddens both develop and
  staging, with the anchor asserted as applied (2 occurrences), and the
  unmutated cell probes clean.

FINDINGS: ['.github: develop (develop) does not REQUIRE selftests-RENAMED ...',
           '.github: staging (staging) does not REQUIRE selftests-RENAMED ...']

Provenance

Found by Bugbot on release-train promotion PR #268 (High). Per the staging-hop
policy, findings at develop -> staging are fixed on the source branch. This
unblocks the .github leg of the current staging hop.

Checklist

• Targets develop
• Single self-contained change
• Mutation-proved against live state
• No secrets or customer data

---

Note

Low Risk
Contract-only change to repo-inventory.yml; it strengthens the conformance audit and does not alter runtime code or live GitHub settings by itself.

Overview
Documents that .github must treat the selftests status check as required on develop and staging, not merely run it. The inventory replaces plain required cells with divergent entries that list the fleet baseline contexts plus selftests, so caller-drift / evaluate_protection() fails if that context is dropped from branch protection.

prod stays on the fleet baseline only; inline comments record that selftests is intentionally not required there until the workflow is on staging, avoiding PRs stuck on a check that never reports.

The added commentary ties this to backend#1680 / backend#1729: a non-required guard is advice, and the prior gap let reusable selftest suites go red without blocking merges.

^{Reviewed by Cursor Bugbot for commit 84637ce. Bugbot is set up for automated code reviews on this repo. Configure here.}