docs: Tier 3 gate probe (positive control, doc-only)

[hyperpolymath]

Positive control for ruleset 23359343 Optimus-Branch, armed today.

Documentation-only by design — no workflow, no action pin, no registry — so a red
result here is a fault in the gate, not in the change.

What this probe is measuring:

1. The four required contexts (CodeQL, SonarCloud Code Analysis,
   governance / Code quality + docs, uses ⊆ actions.lock) all reach a
   terminal state on a real PR head.
2. Whether the code_scanning rule passes when Scorecard has published no
   analysis to refs/pull/N/merge — measured at 2 of 696 pull-ref analyses
   (0.3%), so this is the expected case, not an edge case.
3. That mergeStateStatus now reflects the ruleset, with
   current_user_can_bypass reading never.

Already established while preparing this probe: a commit created through the
GitHub contents API is unsigned, so it cannot satisfy required_signatures.
This branch was therefore committed locally with ssh signing and verifies
valid on the remote. Any agent that writes via the contents API will be
blocked by this ruleset.

Close and delete the branch once the measurement is recorded — the findings live
in dev-notes/governance-and-standards/, not in this repo.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YJ6PbZUYBcjJv7FTRfyogo

[coderabbitai]

Warning

Review limit reached

Next included review available in 32 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 9010b9dc-b99f-4052-8a87-bbe60fc4fc01

📥 Commits

Reviewing files that changed from the base of the PR and between 991b13e and 2c03a20.

📒 Files selected for processing (1)

• docs/tier3-gate-probe.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud