Branch protection on main does not require any test job to pass

What

main's required status checks are:

• Detect Changed Paths
• Dependency Review
• Validate Shipwright Manifest
• Analyze (actions), Analyze (csharp), Analyze (javascript-typescript), Analyze (rust)

That is CodeQL, the dependency scanner, and the manifest validator. No test job is required. Not .NET / Sidecars, not Rust / Shard 1/2 or 2/2, not VS Code / Full Suite + Coverage, not any of the seven VS Code (Windows) chunks, not Lint / All Languages.

Why it matters

A PR whose entire test suite is red is still mergeable through the GitHub UI or gh pr merge — nothing blocks it. The coverage ratchet in particular runs inside .NET / Sidecars and Rust / Coverage Gate, so a coverage regression is likewise unenforced at the merge boundary. The gates exist and work; they just are not wired to branch protection.

This surfaced while merging #200: the coverage gate was failing and GitHub still reported the PR as blocked only on its draft status.

Suggested fix

Add to the required set at minimum:

• Lint / All Languages
• .NET / Sidecars
• Rust / Shard 1/2, Rust / Shard 2/2, Rust / Coverage Gate
• VS Code / Full Suite + Coverage
• the VS Code (Windows) chunk jobs

Note that jobs gated on detect-changes report as skipped rather than passing when their paths are untouched; required checks need to tolerate that (GitHub treats a skipped required check as passing, so this is generally safe, but worth confirming per job).

Also worth deciding whether enforce_admins should be on — it is currently false.

Start by inspecting the repository's GitHub branch-protection settings and the listed workflow job names. Add the minimum test, coverage, and lint checks to the required set, verify how skipped detect-changes jobs are treated, and decide whether enforce_admins should be enabled. Done means failing tests or coverage can no longer merge through the GitHub UI or gh pr merge.