Port studio governance gates to portico (parent)

---
feature_id: FEAT-studio-dependency-map-policy
labels:
  - governance
  - portico
  - parent-ticket
---

## Context

Studio (operant-health/operant-studio) applied ruleset id [REDACTED-MRN] on [REDACTED-DOB] requiring five contexts on main: build, Check PR size, Check ticket trailer, Reject fabricated verification evidence, Parse inventory and assert declared self-tests exist. See KNUCK-A043 and merge commit 63b241eb57bc.

Portico (operant-health/portico) ruleset id [REDACTED-MRN] does not have the equivalent contexts because the underlying workflows do not exist on portico:

- Fabricated-evidence tripwire (KNUCK-A028/A029/A030) -> studio only
- Guard-inventory self-test (KNUCK-A032) -> studio only
- Check ticket trailer (OPER-D2 + KNUCK-A035) -> studio only

Portico has its own `Check PR size` (`.github/workflows/pr-size.yml`) and its own `Knuckles A031 required-not-skipped` invariant, so those two are already covered.

Goal: port the three missing workflows + supporting scripts to portico, verify each is safely required-checkable, then promote them to portico's ruleset id [REDACTED-MRN].

## Acceptance Criteria

- [ ] KNUCK-A045a (tripwire port) closed
- [ ] KNUCK-A045b (guard-inventory port) closed
- [ ] KNUCK-A045c (ticket-trailer port) closed
- [ ] KNUCK-A045d (portico ruleset promotion PR) closed
- [ ] Portico ruleset [REDACTED-MRN] includes at minimum: existing 8 contexts + Check ticket trailer + Reject fabricated verification evidence + Parse inventory and assert declared self-tests exist
- [ ] Post-promotion: on a synthetic bad PR (scaffolding tripwire hit), portico refuses merge

## Provenance

Discovered while filing the KNUCK-A043 follow-on portico ruleset PR on [REDACTED-DOB]. Studio SHAs at fetch time: studio-boil `a93cee3a`, portico-boil `0b197a7a`, portico-claude `2c3ac404`.