Promote ported governance gates to portico required-status-checks (child of KNUCK-A045)

---
feature_id: FEAT-studio-dependency-map-policy
labels:
  - governance
  - portico
  - ruleset
  - blocked-implicit
---

## Context

Parent tracker: KNUCK-A045. Prerequisite tickets (implicit blockers, must be DONE before this fires): KNUCK-A045a, KNUCK-A045b, KNUCK-A045c.

After A045a/b/c have merged and each workflow has demonstrated a green run on the port PR itself, update portico ruleset id [REDACTED-MRN] to add the new contexts.

Mirror the SENT-4 rulesets-as-code convention already used on portico:

- Update .github/rulesets/main-no-agent-admin-bypass.json to include the new contexts.
- Update or create scripts/apply-main-ruleset.sh (portico already has a similar script from SENT-4) to include the new payload.
- Portico uses ~DEFAULT_BRANCH (not refs/heads/main) in the ref condition -- preserve.
- Portico uses bypass_actors: [] (no admin bypass) -- preserve; this is stricter than studio admin-bypass allowance.
- Portico uses required_linear_history: true -- preserve.

Contexts to ADD (all path-filtered workflows -- verified 2026.09.08 that GitHub required-status-checks evaluator accepts no-run-at-all as fine; only skipped conclusion or failure blocks merge):

- Check ticket trailer (from A045c; runs on every PR unconditionally)
- Reject fabricated verification evidence (from A045a; unconditional on PRs)
- Parse inventory and assert declared self-tests exist (from A045b; path-filtered to guard-inventory doc, script, and check/no workflows)

DO NOT add yet (waits on separate work):
- Dep Map Rebuild -- push-only trigger, not PR-eligible until reshape (out of scope)
- Incremental dep-map rebuild / dependency-map audit -- studio version blocked on KNUCK-A044 widening; portico version does not exist yet

## Acceptance Criteria

- All three prerequisite tickets (A045a/b/c) have merged
- PR updates .github/rulesets/main-no-agent-admin-bypass.json on portico
- Apply-script dry-run confirms diff is additive-only (no drop of existing 8 contexts, no change to bypass_actors, no change to required_linear_history)
- Admin runs apply-main-ruleset.sh (agent PAT lacks repo-admin on portico too)
- Read-back verifies portico ruleset [REDACTED-MRN] now lists 11 required contexts
- Synthetic bad PR (scaffolding tripwire hit + no ticket trailer) is refused merge

## Provenance

Inventory taken from local studio checkout at /home/user/workspace/operant-studio-work on 2026.09.08.