Merge Gate - required checks, and the statuses that lie

What actually stops a merge on main. The set of required checks is queried from branch protection at run time rather than listed in any script, because that set has grown twice. A merge is refused when a check is not green, and separately when the branch truly conflicts. Two ways a reported status misleads a reader: a check that self-skips still reports success in seconds while having tested nothing, and a cancelled job reports failure while having reached no verdict at all.