ci(gate): require CI gate again — it is the only thing gating the path-gated legs

[wshallwshall]

CI gate was restored to branch protection on 2026-07-30 (13 contexts, verified against the API before and after). This syncs the repo's checked-in claim and every prose statement that moves with the count.

Why it belongs in the required set

CI gate is a roll-up, not a test: if: always() over six legs that are path-gated or nightly — sqlserver-store, postgres-store, load-test, load-test-sqlserver, windows-service-smoke, changes — failing if any of them failed or was cancelled.

Requiring the roll-up is the only way to gate those six. They can't be required directly: a path-gated job doesn't report on a PR that touches none of its paths, which is the required-but-absent trap and would wedge every such PR forever. The roll-up always reports, so it's safe to require — verified on a real run where all six legs skipped and CI gate still returned success.

It matters because those six cover exactly what the three test legs skip: the store suites skip unless a leg supplies the database. While it was off the required set, a PR touching the SQL Server or Postgres store, the load path, or the Windows service could merge with those legs red and nothing on the merge path would notice.

Why the obvious objection doesn't hold

Checked its record before recommending it — 18 success / 2 failure over 20 runs, and neither failure would have blocked a PR:

run	event	cause
30518291879	schedule	nightly sqlserver load-test legs failed — not a PR context
30510353692	pull_request	superseded re-push, every job cancelled; CI gate fails on cancelled by design, but protection gates on the latest head SHA

ci.yml's own concurrency note already records that auto-merge tolerates cancelled contexts on superseded SHAs.

The file's stale note — written when it was removed, saying it is not in the list — is replaced with the reasoning above, so the next reader learns why it's required rather than just that it is.

Scope

Same four-file shape as the last sync, and the drift test named every one: the count pin in test_required_contexts.py, the job-collapse pin in test_security_posture.py (13 contexts → 11 distinct jobs; the three test legs share one matrix job), docs/CI.md's bullet list, and the "12 status checks" prose in tests/test_push_guard.py and scripts/hooks/push_guard.py.

Verified: the file parses to 13 and is identical to what the API returns; 64 tests pass across the drift, posture, push-guard, ledger, backlog and worktree-constraint suites.

Separately, and not fixed here

That nightly failure is real: load test (smoke, sqlserver) failed on both 2022 and 2025 against 9b3606ed. With CI gate required again, a PR touching the load path will block on it until it's fixed.