ME-RV-073 — Complete required CI

[fraware]

Summary

Required checks on protected main; pin installers; exe/ideal smoke.

Normative: 11_SECURITY_CI_RELEASE_TOOLCHAIN.md (ME-RV-073)

Scaffolding landed

• just check: exe-smoke, ideal-membership-smoke, env-audit-scaffold.
• CI truth: docs/validation/ci/wave7_scaffold_ci_truth.json.

Acceptance

• Branch protection with required checks
• Checksum-pinned elan
• Full required check list green on release commit

Blocked on humans/org

Branch protection currently API 404; elan still mutable master script.