check: read a workflow that carries triggers beside workflow_call

[max-sixty]

Two defects found while running tend against a repo whose tests.yaml declares workflow_call alongside pull_request, push, schedule, and workflow_dispatch.

The check called that workflow unreachable. _effective_triggers treated any workflow declaring workflow_call with no in-repo caller as reachable only from outside, so the whole credential-environments sweep degraded to SKIP and verified nothing on a repo that was otherwise fine. Reachability now anchors on a workflow carrying triggers of its own and follows the call graph out from there, which also catches the case the old rule let through: a callee whose only route in is another workflow nothing here starts. That direction only adds unknowns.

uses: detection missed the absolute self-referencing form. A repo may call its own reusable workflow as owner/repo/.github/workflows/x.yaml@ref to pin the ref it runs. Under the old rule that looked uncalled and failed safe to "unknown"; under the new one it would have been a false pass, so both spellings now resolve to the same file.

Neither change can turn a FAIL into a PASS: resolved trigger sets only grow, and ungated is decided before unresolved is consulted.

install-tend §3 taught only half the gate. The section told adopters to pin every credential-holding environment to admin-gated refs, while the check accepts either a ref policy or required reviewers who exclude the bot. Following it literally breaks a github-pages environment whose deploy runs from refs/pull/N/merge — no branch or tag policy can name that ref, and such an environment is typically already reviewer-gated. The section is now "Environment gates" and carries both routes, when each fits, and a recipe for the reviewer one.

Verification against the live API

Before, on a repo with that workflow shape:

unresolved: ('tests.yaml is only reachable via `workflow_call` from outside this repo',)

After:

unresolved: ()
env_steerable: {'github-pages': [], 'tend': ['repository_dispatch'], 'release': ['release']}

tend check on this repo reports PASS credential-environments end to end. Three tests added; each fails on the pre-fix code.

This was written by Claude Code on behalf of max-sixty