Adopt merge-blocking Bash validation and quality checks #540

Goal

Require the framework validation contract before merging main without adding an unavailable second-maintainer approval requirement.

Background

Engineering review of a90aa1429647b6eb4820a01aabe37799ca55ad5e on 2026-10-03. Original developer checkouts were preserved.

Live rulesets on 2026-10-03 require only base/issue-branch-policy; classic branch protection has no product contexts. docs/ci-policy.md explicitly describes this as an intentional modest baseline, so this issue proposes a policy improvement rather than labeling the current configuration a defect. Tests and Quality already provide substantive Bash/runtime/release evidence.

Scope

Introduce/select stable product-validation and quality contexts, enforce them after a successful trusted run, and update the documented policy.

Acceptance Criteria

• A product aggregate covers supported macOS/Linux validation, minimum-runtime/required compatibility evidence and the intended release-contract checks; quality remains mandatory.
• Unexpected skipped/cancelled/failed dependencies cannot produce a green required aggregate.
• Exact contexts and Actions integration identity are verified in effective live rulesets.
• Keep current solo-maintainer review count unchanged and metadata intake outside product gates.
• Re-running Base repository configuration preserves the controls.

Validation

Run workflow fixtures and hosted validation, then read back rulesets and classic branch protection. Record the before/after policy and explain intentionally advisory lanes.

Evidence

• .github/workflows/tests.yml
• .github/workflows/quality.yml
• docs/ci-policy.md

Dependencies

basefoundry/base#2451 — preserve existing repository controls before relying on additive policy reconciliation.

Non-Goals

No unrelated architecture rewrite, release publication, or automatic live repository-policy change as part of review intake. Implementation follows the issue-backed worktree and reviewed PR workflow.

Project Fields

• Status: Backlog
• Priority: P2
• Area: CI
• Initiative: Adoption Polish
• Size: S
• Issue type: Task
• Assignee: codeforester
• Scheduling: milestone and target date intentionally uncommitted; this review does not make a delivery-date promise.

Agent Assignment

Assignee: @codeforester. Policy-strengthening proposal: confirm the intended required lanes before implementation; no settings were changed by this review.