fix(ci): run push lanes past PR-only skips

[ty-everett]

Program and scope

• Tracker or issue: follow-up to fix(auth): contain untrusted transport failures #413 and main CI run 30662177754
• Program gate(s) advanced: dependency-aware CI; fail-fast orchestration
• Why this change is needed: push CI skipped prepare because PR-only prerequisite jobs were intentionally skipped, causing aggregate gates to fail without executing affected work.
• Explicitly out of scope: package code, package versions, dependencies, release artifacts, and deployment behavior.
• Exact head SHA reviewed: 412d2f9

Impact

• No public package source or manifest changed
• Public package source or manifest changed; affected packages are listed below
• Infrastructure source, dependency, image, or deployment configuration changed
• Public API, exports, types, runtime targets, or browser/mobile behavior changed
• Security-sensitive boundary changed
• Documentation or examples changed

Affected packages/services and intended patch versions: none.

Verification

• Local commands and results: Node 24.18.0; node --test scripts/ci-orchestration.test.mjs (5/5); pnpm health:check (126/126 plus all policy checks); pnpm lint; pnpm format:check; pnpm build; pnpm typecheck.
• Hosted CI run: CI 30662903150 and CodeQL 30662903006 passed for the exact head.
• Conformance evidence: not selected; no conformance input changed.
• Coverage delta: no product source changed.
• Lint/typecheck delta: zero warnings and zero type errors.
• Browser/mobile/packed-consumer evidence: not selected by dependency-aware scope; no package input changed.
• Performance or bundle-size delta: no runtime artifacts changed.
• I self-reviewed the complete diff for correctness, security, compatibility, public API, artifacts, dependencies, docs, and operations
• All applicable checks are terminal and successful on the exact head; any scope-based skip is expected and validated by the merge gate

Security and dependencies

• No dependency or lockfile change
• Changelog, runtime relevance, peer compatibility, transitive graph, and audit results were reviewed
• CodeQL/negative tests cover any changed trust boundary
• The exact-head CodeQL analysis has no new alert
• The exact-head repository quality gate reports zero new Sonar findings and zero unreviewed hotspots
• No new override, advisory dismissal, quality suppression, or skipped test
• Workflow permissions and lifecycle-script behavior remain least privilege

Dependency evidence

• Release notes and necessity: Not applicable — no dependency changed.
• Runtime, build, and peer compatibility: Not applicable — no dependency changed.
• Deduplicated lockfile: Not applicable — lockfile unchanged.
• Audit and CodeQL: health checks passed; hosted CodeQL pending.
• Package and consumer tests: dependency-aware scope correctly selects no package tests for a workflow-only change.
• Bundle and performance impact: Not applicable — no dependency changed.
• Affected public package versions: Not applicable — no dependency changed.

Release and operations

• No npm publication was performed from a workstation or from this PR
• Required npm patch bumps are included or intentionally deferred by the controlling program
• Image/SBOM/provenance/deployment/rollback impact is documented
• Documentation, changelog, migration, and operational guidance are current

Completion evidence

• Documentation, changelog, migration notes, release notes, and operator guidance are current or concretely not applicable
• One qualified maintainer approval is sufficient; no last-pusher restriction is assumed

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud