decide: enforce_admins is off on main, so admin merges bypass required checks that have nothing to report

[rubenhensen]

Question

main's branch protection has enforce_admins.enabled: false (confirmed live via gh api repos/encryption4all/postguard/branches/main/protection, required_status_checks.contexts: ["Wire compat"]). That means an admin merge bypasses the sole required check entirely whenever it has nothing to report — not just when it's failing, but when it never ran at all.

This isn't hypothetical: #297 merged yesterday with zero GitHub Actions runs against any of its three commit SHAs, during the GitHub-wide Actions incident that task: GitHub Actions runs are stuck queued repo-wide; unblock the runner backlog root-caused and resolved. The required-check gate this map spent real effort building (#251/#260/#261/#262) is not actually a backstop for admin merges during any outage or backlog like that one — it only holds during normal operation, when the check reliably reports.

Decide how to close this gap. Candidate directions, not exhaustive:

• Turn enforce_admins on. Tradeoff: no more admin bypass at all, including for legitimate emergency merges (e.g. a hotfix needed while CI itself is down, which is exactly the scenario that just happened) — an outage could then block all merges, not just risk silently waving one through.
• Leave enforce_admins off but add a second layer that specifically catches "check has no report" as distinct from "check failed" (e.g. a status check that defaults to failing/pending rather than simply absent).
• Accept the risk and document it (the current state), on the reasoning that admin merges are rare and reconcile the map tree with what actually landed (open-but-done, closed-but-not-done) #281-style manual reconciliation already exists as a safety net.

Whichever direction: record the decision and, if it's a config change, the change itself (branch protection settings aren't in a file this repo's CI can gate on, so verify by re-reading branches/main/protection after).