Port guard-inventory self-test to portico

---
feature_id: FEAT-studio-dependency-map-policy
labels:
  - governance
  - portico
  - guard-inventory
parent: KNUCK-A045
---

## Context

Port the guard-inventory self-test (studio KNUCK-A032) to portico. Files to copy from operant-health/operant-studio at HEAD as of [REDACTED-DOB]:

- `.github/workflows/check-guard-inventory.yml` (1526 bytes) -- job name is `Parse inventory and assert declared self-tests exist`
- `scripts/check-guard-inventory.ts` -- SUT
- `docs/knuckles-guard-inventory.md` (30 lines) -- source-of-truth inventory

On portico, this requires generating a fresh guard-inventory doc that maps portico's `.github/workflows/check-*.yml` and `no-*.yml` set:

Portico guards existing:
- `check-knuckles-a033-selftest.yml` -- has selftest job
- `check-org-scoped.yml` -- unknown
- `check-required-not-skipped.yml` -- has selftest job
- `sent4-admin-merge-sentinel.yml` -- unknown
- `rebase-strategy-guard.yml` -- unknown
- `main-e2e-guard.yml` -- unknown

Each entry in the new portico-side guard-inventory doc needs either `selftest: yes` + a named self-test job, or `selftest: no` + a KNUCK-A032 gap marker.

## Acceptance Criteria

- [ ] PR on portico that copies the workflow + script + a fresh doc for portico's guard set
- [ ] Every existing portico `check-*.yml` / `no-*.yml` / `*-guard.yml` / `*-sentinel.yml` is listed in `docs/knuckles-guard-inventory.md`
- [ ] Every entry either has a working `selftest: yes` job or a KNUCK-A032 gap marker (with a Ledger followup ticket)
- [ ] The workflow runs green on the PR itself
- [ ] Follow-up separate PR (KNUCK-A045d) adds the context to portico's required-status-checks list

## Provenance

Parent: KNUCK-A045. Blocks: KNUCK-A045d.