Gates should assert their own workflow wiring, so an unapplied patch fails loudly

[rubenhensen]

Every gate in this epic was landed in two halves: dobby writes the code and tests, and a maintainer applies the workflow YAML by hand, because the App has no workflows: write. Nothing detects a missing second half. The failure is silent and the PR is green.

It has already happened twice:

• postguard#265 merged with pg-compat in the tree and no job calling it. The crate was inert until ci: run the wire-compat gate (published pg-core opens HEAD-sealed samples) #266 landed the workflow separately.
• postguard-js#137 merged with integration.yml patched but delivery.yml not, so the release path would have failed on the next publish — caught in review, not by CI.

encryption4all/cryptify#203 solves this properly. Its the_workflow_uses_the_settings_this_module_pins test reads .github/workflows/api-diff.yml, asserts the gate's fail-on and include-checks match the constants the test module pins, and fails with both sides named:

.github/workflows/api-diff.yml and this module disagree about what the gate does:
  fail-on: the gate runs with ERR, this module pins WARN
  include-checks: the gate runs with nothing, this module pins response-non-success-status-removed,...

That turns "the maintainer forgot to apply the patch" from an invisible no-op into a red cargo test, and it also stops the settings drifting away from the mutation test that certifies them.

Worth copying to

• postguard — wire-compat-rust / wire-compat-js / semver-checks / api-diff. pg-pkg/tests/api_gate.rs already pins the oasdiff settings in spirit; extend it to assert the workflow's inputs the way cryptify's does. The wire gates are the higher-value target: they are required checks, and a silently-unapplied change to them means a required check that certifies nothing.
• postguard-js — website.yml / tb-addon.yml / the API-surface gate. The tb-addon one has a concrete hook already: check-version could also assert the release job's tag prefix is tb-addon-v, since a bare v* would be a silent no-op release.

The alternative

Granting the App workflows: write removes the hand-off entirely. It has now cost six round trips (postguard#266/#267/#269/#270, postguard-js#134/#135/#137, cryptify#203). Rejected earlier on the grounds that an agent able to edit workflows can alter the gates and reach workflow-level secrets — which is exactly the layer this epic hardens — and that reasoning still holds. But the guard tests above are what make the hand-off safe rather than merely tolerated, so they are worth having either way.

Part of #247 (workstream C).

[rubenhensen]

Status while reconciling the map tree (#281): the api-diff half of this is already done in this repo, so what remains is narrower than the body suggests.

pg-pkg/tests/api_gate.rs::the_workflow_step_matches_the_pinned_inputs reads .github/workflows/api-diff.yml and asserts fail-on, include-checks and the pinned action ref against the constants the test module pins — the same guard as cryptify#203, landed with the gate itself in 71e9f50 (#269).

Remaining in this repo, and they are the higher-value targets this body already names, since these are the required checks:

• wire-compat-rust
• wire-compat-js
• semver-checks

Nothing outside scripts/semver-checks.sh reads build.yml today, so an unapplied change to any of those three is still a silent no-op. The postguard-js targets (website.yml, tb-addon.yml, the API-surface gate) are untouched.

One widening worth folding in: the same shape just bit a history-preserving import, not a gate. ba380a14 (the cryptify merge) carried imported closing keywords that silently closed a live issue here (#146, now reopened). Different mechanism, identical failure signature — a second half nobody checked, and a green PR. encryption4all/postguard-js#139 holds that guard; this issue is where the "assert it instead of remembering it" principle lives.