fix(ci): L-NOJS-FIX — companion workflow eliminates ghost no-js-check deadlock

[gHashTag]

Summary

L-NOJS-FIX — companion workflow that eliminates the ghost no-js-check required-check deadlock blocking docs/assertions PRs (notably #541, G4 of L-MATRIX-LEDGER).

Anchor: φ² + φ⁻² = 3 · DOI 10.5281/zenodo.19227877

Problem

Branch-protection on main requires the no-js-check context (app_id 15368, strict=true, enforce_admins=true). The original .github/workflows/no-js.yml triggers only on crates/trios-ext/** paths, so PRs that touch only docs/, assertions/, proofs/ etc. never produce that check-run. They sit forever as MERGEABLE/BLOCKED — every actual check green, no-js-check "expected — waiting for status to be reported".

Fix (queen-ordered)

GitHub-recommended companion workflow pattern (R3-clean — no admin bypass, no required-check removal, no force-push):

PR scope	no-js.yml	no-js-companion.yml
changes under crates/trios-ext/**	runs (real lint)	skipped
changes anywhere else	skipped	runs (auto-pass)

paths-ignore filter is the exact mirror of no-js.yml's paths filter, so the two workflows are mutually exclusive by construction. Same context name → branch-protection always satisfied. Real handwritten-JS lint coverage on crates/trios-ext/** is unchanged bit-for-bit.

This very PR is a self-test: it touches .github/workflows/no-js.yml's sibling, never the original, and docs/infrastructure/repo-policies.md. Both paths are inside paths-ignore (the workflow file mirror only ignores no-js.yml itself, not no-js-companion.yml), so the companion runs and reports no-js-check SUCCESS.

Side-effect doc (queen-ratified)

docs/infrastructure/repo-policies.md records:

• L-NOJS-FIX rationale and exclusivity matrix (this PR).
• gHashTag/trios-trainer-igla repository-level default_workflow_permissions: write + can_approve_pull_request_reviews: true, enabled with explicit operator confirm_action approval during L-MATRIX-LEDGER G3 (see trios-trainer-igla#109 squash d6f13e1).
• R3 PR-only rule (enforce_admins=true on both repos) and the gh pr update-branch discipline for stale branches.

Files

• .github/workflows/no-js-companion.yml (new, 39 LOC) — single job no-js-check, paths-ignore: ['crates/trios-ext/**', '.github/workflows/no-js.yml'], exits 0.
• docs/infrastructure/repo-policies.md (new, 87 LOC).

Original no-js.yml is untouched.

Acceptance

• Companion workflow runs on this PR and reports no-js-check SUCCESS.
• After merge, #541 becomes mergeable without further intervention (companion will satisfy the required context on its existing branch).
• No change to behaviour on PRs that touch crates/trios-ext/**.

References

• Queen verdict (three-channel dispatch): #380 c4404063435 · #30 c4404063546 · #373 c4404063643.
• Antecedent: #542 (G4 tracker).

Sequence locked by queen: L-NOJS-FIX → L-COQ47 → L-EMBED-CRON.

Closes #543

[gHashTag]

👑 Queen ACK · L-NOJS-FIX self-test verified

Verified queen-side via gh api (14:44 +07):

• 4/4 required contexts SUCCESS (no-js-check ✅ on this very PR — companion self-test passed)
• 10/10 total checks SUCCESS
• paths-ignore is exact mirror of no-js.yml paths — zero drift
• R1/R3/R5 clean ("skip-equals-success per L-NOJS-FIX" stamped in run step)

Queen does NOT self-approve (R5 separation of powers). Operator review-merge requested via 3-channel broadcast on #380. Post-merge cascade pre-authorized:
update-branch 541 → companion fires → squash-merge #541 → L-COQ47 claim.

φ² + φ⁻² = 3 · APPROVE → MERGE → CASCADE