Mark existing CI checks as required status checks (ADR-0009)

[ss-o]

What

Mark this repository's existing CI checks as required status checks in its branch ruleset for main.

Why

decisions/0009-testing-ci-strategy.md in z-shell/.github (accepted 2026-07-25) requires class-1 (continuously deployed) repositories to gate merge on the build succeeding before deploy -- specifically the Docker build matrix for this repository. A read-only audit on 2026-07-25 found this repository's ruleset has copilot_code_review, deletion, and non_fast_forward rules, but no pull_request rule and no required_status_checks rule -- so relevant workflows run but are not required for merge, and merges are not gated on an approving review either.

Correction (2026-07-25)

The paragraph above originally named test-matrix.yml as the second unenforced suite. That was wrong: test-matrix.yml triggers only on schedule/workflow_dispatch, never on a pull request, so it cannot be a required check. The workflow that actually runs unconditionally on every PR to main is test-native.yml (job zunit, matrix over annexes/ice/packages/plugins/snippets), confirmed by its on: block and by the check names on merged PR #77.

What was done

Applied 2026-07-25. Created a new ruleset ("Required PR checks for main") requiring:

• pull_request (code owner review required, 0 minimum approvals, matching the wiki/src convention)
• required_status_checks:
  • build-versioned (5.5.1), (5.6.2), (5.7.1), (5.8), (5.8.1), (5.9) from docker.yml
  • zunit (annexes), (ice), (packages), (plugins), (snippets) from test-native.yml

All 11 contexts were confirmed to run unconditionally on every pull request to main (no path filters on either workflow's pull_request trigger) before being required. build-latest (docker.yml) and test-matrix.yml were deliberately excluded: build-latest's push step only runs on main itself so it is a no-op check on PRs, and test-matrix.yml never fires on PRs at all.

The pre-existing classic branch protection on this repository (separate from rulesets; notably allow_force_pushes: true) was left untouched -- only a new ruleset was added, per the pattern already established on wiki and src. allow_force_pushes: true on main is outside this issue's scope but worth a maintainer look separately.

References

• decisions/0008-branching-model.md, decisions/0009-testing-ci-strategy.md in z-shell/.github
• z-shell/.github#454, z-shell/.github#478

[ss-o]

Implemented; see updated issue body for exactly what was applied and verified.