fix(ci): the required SET is readable — retire the 403 premise and diff the live ruleset

.github/workflows/lint.yml

@@ -870,9 +870,14 @@ jobs:
  # the machine-readable form of #5617's audit exclusions. It deliberately
  # does NOT judge job-level `if:`: four of the enrolled ci.yml jobs carry a
  # filter-driven `if:` by design (#4928), and a skipped job still publishes
- # a context. ⚠️ It cannot verify the required SET itself — Settings →
- # Rulesets is unreadable from every agent seat (403) — so it asserts the
- # repo-side half only, and the script's header says so at length.
+ # a context. ⚠️ It does not read the required SET itself — but not because
+ # it cannot: the rulesets API answers 200 to an ordinary seat (it is the
+ # CLASSIC branches/main/protection endpoint that answers 403, and this repo
+ # does not use classic branch protection — #9642). The live diff is a
+ # separate report-only mode, `--verify-required-set`, deliberately kept OFF
+ # this required path: the settings half of a rename is maintainer-only and
+ # lands after the merge, so a blocking version would be red on the very PR
+ # carrying the repo half. This step stays network-free.
  # Reads two YAML files; sub-second.
  - name: Required-context name pin
  run: pnpm check:required-contexts

scripts/check-partof-closing-keyword.mjs

@@ -98,8 +98,13 @@
  *
  * It also does not decide branch protection. This publishes a red check run;
  * whether that check run becomes a REQUIRED context is a settings change no
- * agent seat can make (the protection endpoint answers 403 here) and, per the
- * required-context registry convention, one that carries a maintainer ruling.
+ * agent seat can make — the seat reads the repository as a non-admin
+ * (permissions.admin false) — and, per the required-context registry
+ * convention, one that carries a maintainer ruling. ⚠️ Not-writable is the
+ * claim here, and only that: the required set is READABLE from an ordinary
+ * seat (the rulesets API answers 200; it is the classic branch-protection
+ * endpoint that answers 403, and this repo does not use classic branch
+ * protection — #9642, which retired that conflation elsewhere in this tree).
  * The duplicate-fix guard sits in exactly the same position.
  *
  * ## Why the paths above are unquoted