Read the triggers and the conditions into the parity document (#62)

[iderex]

Refs #62

What this changes

The document gains a section under the walk of which contexts arrive, saying
which of the ways a required context can fail to arrive are readable in the
workflow files and what those files say today. Three commands and their output:
no workflow carries a path filter, three files carry no branch filter that
reads every branch and none of the three narrows a pull request by it, and two
files carry a condition at all, neither of them on a name the table keeps.

Nothing else in the document moves and no other file is touched.

What failure it prevents

A required set assembled from names that arrive on some pull requests only,
with the document beside the set silent about which names were read for it. The
reading that existed at all lived outside the tree and was made before one of
these workflow files was written, so a reader asking what stands behind a merge
could not find it where the rest of the walk is, and could not tell how much of
the tree it had covered.

What was run

I ran the four commands CONTRIBUTING.md names, at the commit being pushed, and
the checker over this tree. The suite output is the tail of the run.

$ go build ./cmd/... ./internal/...
$ go vet ./cmd/... ./internal/...
$ gofmt -l cmd internal
(no output)
$ go test -count=1 ./cmd/... ./internal/...
ok  	github.com/Flowfin/lab/cmd/contexts	1.563s
ok  	github.com/Flowfin/lab/cmd/lab	3.735s
ok  	github.com/Flowfin/lab/cmd/notices	16.698s
ok  	github.com/Flowfin/lab/cmd/pullrequest	3.020s
ok  	github.com/Flowfin/lab/internal/check	2.838s
ok  	github.com/Flowfin/lab/internal/contexts	1.972s
ok  	github.com/Flowfin/lab/internal/hardware	2.133s
ok  	github.com/Flowfin/lab/internal/invariants	2.738s
ok  	github.com/Flowfin/lab/internal/notices	1.925s
ok  	github.com/Flowfin/lab/internal/prose	3.157s
ok  	github.com/Flowfin/lab/internal/pullrequest	3.353s

$ go run ./cmd/lab check .
examined .
1 experiment directory walked, 1 record read
18 decision records read
the time this run read is 2026-08-17T05:04:44Z
0 refused

The invariants leg refused this change twice before it was written the way it
is now. The first draft pasted git grep -A1 output, whose context lines end a
path with a dash, and document-names-a-path-that-does-not-resolve refused
both of them by name:

docs/quality-parity.md: it names .github/workflows/dco.yml-, which is not in this tree (document-names-a-path-that-does-not-resolve)
docs/quality-parity.md: it names .github/workflows/dependency-review.yml-, which is not in this tree (document-names-a-path-that-does-not-resolve)

Every command the section quotes was run at 1fc6961 and its output pasted
from that run rather than retyped.

What this does not do

This is not the end of #62. The first clause of that issue compares what arrives
against the required set, the set on this board is empty, so there is nothing
to compare against. The fork clause is untouched: no pull request from a fork
has been opened on this board and nothing here opens one.

It says nothing about what a job does once it has started. A context that
arrives having done nothing is a different question, and the section says so
where it states its bound.

One line in it is a claim rather than a measurement, and it is written as a
claim: that the three event types dco.yml names are the three the platform
runs a pull-request workflow for when a file names none. That is the platform's
documented default, and nothing in this tree measures it.

There is no second reader for this change tonight. What stands in place of one
is the output above and the commands in the section, each of which reproduces
against origin/main.