fix(reviewer): require the full configured check set present + green before merge (guard D)

[ProtocolWarden]

The hole #272 + Guard C left open

Those close "merge on red CI", "merge while checks run", and "merge on a head with no checks at all". But a required check in a separate workflow registers slightly after the main CI workflow. In that window it's invisible to both get_failed_checks (no check-run yet) and get_incomplete_checks (not a run yet), so the gate sees the main-workflow checks completed+green and merges before the late check ever runs.

That is exactly how #277/#278 reached main with a red audit job — the very check that surfaces the new OC12/OC13 divergence guards. So without this, a future PR that trips those guards could merge anyway. This is the keystone that makes Guards A/B actually block rather than just report.

Fix

• New per-repo required_checks config (RepoConfig). A check name satisfies an entry if it contains the entry (case-insensitive), matching ci_ignored_checks semantics.
• The primary self-review gate and the WO-3 no-progress merge path now require every configured required check to be present and passing on the current head before treating CI as green. failed is already empty at the gate, so a required check is satisfied iff it appears in the completed set; a missing one defers via the existing ci_wait_cycles bound (escalating ci_never_settled if it never shows).

Activation is per-repo via required_checks (e.g. ["audit"]) in the local config; default empty → no behaviour change for unconfigured repos. (I'll set required_checks: [audit] for OperationsCenter in the live local config once this merges.)

Tests

+2: required check absent → defer (no self-review, no merge, wait counter advanced); required check present+green → proceeds through self-review LGTM to merge. Mock repo_cfg factories default required_checks=[]. Full reviewer suite passes (175); ruff clean; audit clean.

🤖 Generated with Claude Code