ci: run the required-checks audit daily

[CameronBrooks11]

Runs scripts/check_required_checks.py on a schedule, the half of #3 its comment lists as still open.

What it adds

.github/workflows/required-checks-audit.yml:

• on: schedule (daily, 06:17 UTC) and workflow_dispatch;
• permissions: contents: read;
• one job, audit, running python3 -I scripts/check_required_checks.py --public-only with GH_TOKEN set to the job's own token. gh needs a token in the environment even for endpoints that answer unauthenticated.

No pull_request trigger. With one, audit would run on pull requests here and gate nothing, which is the UNGATED finding the script exists to report. Checked offline: adding pull_request: to this file in a saved snapshot makes the script print UNGATED .github: .github/workflows/required-checks-audit.yml: job 'audit' runs on pull requests; 'audit' is not a required check and exit 1. Without it, the snapshot evaluates to the same result as live, so the file parses under the script's YAML subset and contributes no pull_request job.

AGENTS.md §3.2 and README.md now point at it, and the §3.1 row for .github says its one workflow never runs on a pull request.

Observed in Actions

This branch cannot be dispatched before it merges, so a throwaway branch tmp/audit-probe (commit 9ed1335, now deleted) carried this file with an added push: trigger for that branch, plus a second workflow running the same script on two --load snapshot fixtures.

run	job	result	what it printed
37716690043	audit (this workflow, live, job token)	red, exit 2	6 repositories, 6 workflows, 7 pull_request jobs, 7 required checks: 0 finding(s), 4 not evaluated, and an unknown number of private repositories skipped (--public-only)
37716690040	clean (fixture: one PR job, required)	green, exit 0	1 repositories, ... 0 finding(s), 0 not evaluated
37716690040	finding (fixture: one PR job, not required)	red, exit 1	UNGATED demo: .github/workflows/ci.yml: job 'check' runs on pull requests; 'check' is not a required check

So the job token reads all six public repositories, the same totals as a local run with a personal token (python3 -I scripts/check_required_checks.py --public-only). The only difference is that the job token cannot see the org's private count, so it says "an unknown number" where a local run says 1. The green and the exit-1 red come from fixtures, not from the live org.

The audit row above ran before .github#15 merged, so it was red (exit 2) for the reason in the next section.

The live audit is now green (since .github#15)

.github#15 (merged) expands a job that calls a reusable workflow into <caller> / <called job> contexts, so the four INCOMPLETE lines from the first version of this PR are gone. This branch has main merged in (f7b35c7). On this branch at bee8a3f, with a personal token:

$ python3 -I scripts/check_required_checks.py --public-only
1 private repositories skipped (--public-only)
6 repositories, 6 workflows, 7 pull_request jobs, 7 required checks: 0 finding(s), 0 not evaluated
exit 0

$ python3 -I scripts/check_required_checks.py --selftest
selftest: 91 of 91 as expected

The live run reads main, which does not have this workflow yet. Adding required-checks-audit.yml to .github in the saved snapshot (--save, then --load the edited copy) gives 6 repositories, 7 workflows, 7 pull_request jobs, 7 required checks: 0 finding(s), 0 not evaluated, exit 0. So after merge the workflow parses, contributes no pull_request job, and does not report itself.

STATE.md is updated in this PR:

• the audit exits 0 on the org (§1, .github);
• kindkit#26 merged, so each required check has one producer. Merge commit 6ebd80d shows check and kind / conformance from one push suite, both success;
• .github#16, which is still open, is the gap the audit does not see: a required context also produced by push runs on other branches;
• "teach it reusable workflows" leaves the next-work list.

Issue 3 stays open until the first scheduled run is green

#3's acceptance, bullet by bullet:

1. A check exists that fails when a workflow job is not in the ruleset, or a required context matches no job. Met by feat: add a check that every pull_request job is a required check #10 and extended by feat: expand reusable workflow calls into their contexts #15.
2. Its red state is demonstrated in both directions. Met. feat: add a check that every pull_request job is a required check #10's body records UNGATED and ORPHANED on edited snapshots of the real org, and feat: expand reusable workflow calls into their contexts #15's body records both again for the expanded kind / conformance contexts.
3. blockspec, research and .github are picked up automatically when they gain their first workflow. Not yet shown. The script lists every repository in the org on each run, so a new workflow is read without configuration. "Automatically" is the schedule, though, and a schedule only exists on the default branch, so nothing before merge can show it firing.

Shown before merge:

• the job runs in Actions with its own token and reads all six public repositories (run 37716690043, on a throwaway branch);
• the script exits 0 on the live org, and 1 or 2 on fixtures;
• this workflow does not report itself.

Checked after merge:

• a workflow_dispatch run on main goes green with the 0 finding(s), 0 not evaluated line;
• then the first schedule run (06:17 UTC) does the same, which shows the trigger fires.

A closing keyword would close the issue at merge, before either run. This PR therefore uses Refs, and #3 should be closed by hand, citing the first green scheduled run.

One caveat for later, which does not change the above. GitHub disables a public repository's scheduled workflows after 60 days with no repository activity (GitHub's documented behaviour; not observed here). If .github goes quiet for that long, the audit stops running.

Refs #3. Refs #16.