gate hardening: auto-merge has fired on red builds (#334-#336, #344) — require status checks

[hyperpolymath]

Evidence

• .claude/CLAUDE.md (agent-operations notes) records auto-merge firing with build/lint red on PRs feat(stdlib): STDLIB-04a — Mut effect externs (make_ref/get/set) → real impl (Closes #328) #334, feat(borrow): NLL last-use expiry for ref-bindings (CORE-01 pt3 Slice A, Refs #177) #335, docs(adr): CORE-02 / #234 / ADR-016 — truth ledger to "DELIVERED" #336, Claude/happy mendel b4 ie u #344 — "PR merged" does not imply CI green in this repo's history.
• proposals/MIGRATION-PLAN.adoc:218-219 states repo CI is non-gating for migration PRs (authoritative gates are local parity/assail/agda runs).
• The typed-wasm ownership auto-verification on every default compile is informational only — violations print to stderr and the module is still written (bin/main.ml:939-945); the blocking --typed-wasm gate is still TYPED-WASM-ROADMAP Tranche A1 (proposed).

Requested

• Enable branch protection on main with required status checks (at minimum: build + test job of ci.yml) so auto-merge cannot land red.
• Decide which currently-informational gates become blocking, and where: tw_verify (--typed-wasm A1), codegen-WASM engine harness, Deno-ESM harness.
• Document the decision in CAPABILITY-MATRIX/TECH-DEBT so "gate" means "gates".

Context: two execution-verified soundness findings filed today shipped under a 416-test green gate — gate semantics are part of the soundness story, not hygiene.

Filed from the 2026-06-11 whole-picture survey.