ci: gate canonical standard.mk, and unblock PRs in the repo that hosts it

[hunterdsp]

Validating this repo against the process it now documents turned up two defects.

1. Every PR here is unmergeable

The main ruleset requires a check named CI passed; the only workflow (mirror.yml) has no pull_request trigger and reports no such check, so it can never arrive. The only merge path is an admin bypass — a required check that gates nothing.

That matters most here, because canonical standard.mk lives in this repo: every future change to the standard has to arrive through a PR that cannot merge. Same shape and fix as just-buildit/.github#4, and self-bootstrapping — pull_request runs from the merge ref, so this PR is the first one gated by its own check.

2. The README contradicted the standard

It said repo-only targets "go in local.mk". But standard.mk's own comment says "in the Makefile or local.mk", the plan's criterion 1 explicitly permits "config + genuinely local targets" in the Makefile, and the reference adopter keeps all 26 of its own targets there with every gate green. Corrected to say what actually matters: naming them in LOCAL_TARGETS.

The gate is not a rubber stamp

A broken publish here doesn't fail here — it fails in every adopter at once, the moment they re-vendor, because their make lint fetches this file with no cache. So the job checks the three things that would cost that:

check	why
fails cleanly with the config surface unset	asserts on the message, since a syntax error and a deliberate $(error) look alike to make
every feature group defines its targets (9 flags on, ≥38)	catches a group whose variables and targets drifted apart
its own gates pass clean and fail sabotaged	a ghost-check that can't catch a rule-less .PHONY is the exact failure this standard exists to prevent

Plus, on main only: Pages serves what is committed — the drift gate's question asked from the other side.

All four verified locally against the published file before committing: the unset-config case errors naming TEST_CMD; all-flags-on lists 40 targets; the clean tree passes both gates; the sabotaged tree fails naming ghosty.