Separate the fork question for the job that reads the ruleset (#62)

[iderex]

Refs #62

What this changes

The walk of which contexts arrive gains one subsection. Everything that walk
read before is about whether a job starts: path filters, branch and type
filters, and job-level conditions. required contexts can start and still be
unable to finish, because half of what it compares is the ruleset on the
platform rather than a file in the checkout, and it is the only name in the
candidate set with that shape.

The subsection names the workflow, quotes the step that stops the job when the
fetch fails rather than letting it compare against an empty list, and splits
the fork question into the part that is measured and the part that is not.

Nothing else in the document moves and no other file is touched.

What failure it prevents

A required set assembled with required contexts in it, on a board whose
document beside the set has walked the fork question for two upload-derived
names and not for the one name that reads the gate itself. If that fetch cannot
be made from a fork, requiring the context closes the board to anybody who
cannot push a branch to it, which is the second of the three cases the issue is
written against, and the document a reader consults would not have raised it.

What was run

I ran the four commands CONTRIBUTING.md names, at the commit being pushed,
and the checker over this tree.

$ go build ./cmd/... ./internal/...
$ go vet ./cmd/... ./internal/...
$ gofmt -l cmd internal
(no output)
$ go test -count=1 ./cmd/... ./internal/...
ok  	github.com/Flowfin/lab/cmd/contexts	2.703s
ok  	github.com/Flowfin/lab/cmd/lab	5.961s
ok  	github.com/Flowfin/lab/cmd/notices	17.209s
ok  	github.com/Flowfin/lab/cmd/pullrequest	1.239s
ok  	github.com/Flowfin/lab/internal/check	2.368s
ok  	github.com/Flowfin/lab/internal/contexts	2.378s
ok  	github.com/Flowfin/lab/internal/hardware	0.891s
ok  	github.com/Flowfin/lab/internal/invariants	1.422s
ok  	github.com/Flowfin/lab/internal/notices	2.061s
ok  	github.com/Flowfin/lab/internal/prose	2.051s
ok  	github.com/Flowfin/lab/internal/pullrequest	2.080s

$ go run ./cmd/lab check .
examined .
1 experiment directory walked, 1 record read
18 decision records read
the time this run read is 2026-08-17T09:52:15Z
0 refused

Every command the subsection quotes was run before it was written and its
output pasted from that run rather than retyped. The two tracker commands were
run against Flowfin/lab and the two git commands against origin/main at
df980aa.

What this does not do

It does not walk a fork. No pull request from a fork has been opened on this
board and nothing here opens one, so the second half of the token question is
unmeasured and the text says so in the place a reader would otherwise take the
first half as an answer to both.

It settles no name into the required set. That set is empty, which is the same
bound every other sentence in that section carries.

The measurement it does make is of a Dependabot pull request rather than of a
fork. Those two share a read-only token and are otherwise different routes, and
the subsection uses it for the token alone.

The means is prose in the document the issue names as where its results go. It
carries commands and their output the way the rest of that file does, and it
needs no apparatus maintained beside it.

There is no second reader for this change tonight. What stands in place of one
is the output above and the commands in the subsection, each of which
reproduces against origin/main.