ci: require the two gates I built today and then did not require

[avrabe]

Both new jobs in kill-criteria.yml — the composed-graph env sweep (#346) and the MPU
enforcement oracle (#349) — have been running on every PR and gating nothing.

Every other job in that workflow is a required context. These two were not, because I
added them to the workflow and never to branch protection.

That is the #294 defect class, reintroduced by me — in the workflow built to hold
that line, on the day I closed #294 saying the invariant was now watched.

Why the gate that exists for this did not catch it

check-required-contexts asserts that every required context can report. It does not
assert that every gate worth requiring is required. Those are different properties and
I had only built the first.

Worth stating plainly, because "we have a gate for that" is exactly the reasoning that let
this through — the same shape as every other finding in this sweep, applied to my own
work.

Order of operations

Added to protection only after confirming both complete success on main — the
kill-criteria run there is green on all six jobs. Requiring a context not proven producible
is the deadlock #340 was about, and doing that twice would be careless.

Adding to protection first left the committed list at 20 against protection's 22, and the
gate's own --protection direction reported it:

NOT_LISTED  a denied write really faults (REQ-OS-MPU-001 kill-criterion)
NOT_LISTED  no raw env import survives in the composed graph
FAIL: 2 required context(s) may not be produced on a PR      exit 1

That is the second time that direction has caught real drift rather than a planted
one — the first was the 20th context in #343. It is the direction CI cannot check for
itself (GITHUB_TOKEN gets HTTP 403 on branch protection), so it only works when someone
runs it locally, which is an argument for #327's residue rather than a comfort.

This PR closes it: 22 contexts, list and protection matching exactly.

Kill-criterion: a gate lands in kill-criteria.yml and is not a required context.

🤖 Generated with Claude Code

https://claude.ai/code/session_011QG86sovTbfnPNY9SfhSmo

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!