ci/security: enforce exact-head required checks for admins before merge

[reprewindai-dev]

Finding

Canonical main is protected and requires status context verify, but GitHub reports the required-status-check enforcement level as non_admins. That leaves an administrator bypass path even while exact-head cAPI CI jobs are currently being created without runners/steps and concluding failure.

This is a merge-control defect, not evidence that current remediation source failed tests.

Required correction

• enforce the required exact-head verify gate for administrators as well as non-admins;
• require blocking review state to be respected for all merge actors;
• ensure the verify workflow actually receives a runner and executes test/lint/build/security checks;
• run a clean exact-head validation on current default branch after Actions execution is restored;
• add/record a negative administrative merge test proving a failed or non-executed required check cannot be overridden.

Truth boundary

Do not promote source-observed changes or PR prose to VERIFIED because branch protection exists. Current runtime remains NOT_VERIFIED until deployed SHA + HTTP/protocol identity + listener + Traefik routing agree.

This issue is intentionally separate from #44's fail-closed authority code fix; #44 must remain draft until the executable gate actually passes.

[reprewindai-dev]

2026-08-25 reconciliation: cAPI PR #53 exact head c75017b1f3caaa3c7957065387a8f73dc40c8c94 still has cAPI CI run 32705862191 attempt 2 concluding failure with runner_id: 0, empty runner name, and steps: []. This is NOT an executed source-test failure. The same zero-runner/zero-step pattern is present on uacpv3 PR #15 and BYOS dependency-security PR #222. Governance Portal issue reprewindai-dev/veklom-FRONTEND#56 separately records an account billing lock as the reason Actions did not execute there, making an account/org-level Actions availability problem the leading shared explanation. Do not promote this to proven root cause for every repo until GitHub/account Actions availability is restored/confirmed, but stop retrying these jobs as if they were flaky source tests. cAPI remains merge-blocked and runtime 3003 remains NOT_VERIFIED.