feat: verify branch protection requires only the pr-validation-success gate

Issue Description

Confirm with an org/repo admin that GitHub branch protection on main (and release/prerelease, release/stable) lists only pr-validation-success as a required status check, not individual job names from pr-validation.yml.

This matters because the entire "every job must appear in pr-validation-success's needs:" model (enforced by scripts/security/Test-PrValidationGate.ps1) only works if pr-validation-success is the actual merge gate. If branch protection instead requires individual job names directly, then:

• A new job added to the workflow but not required by branch protection could fail without blocking merge, even if it's correctly listed in needs:
• The aggregator gate becomes redundant/bypassable

Additional Context

Blocked on: requires repo admin access to read/verify Settings > Branches > Branch protection rules (the gh api repos/.../branches/main/protection call returned 403 for a non-admin token during discovery).

Deliverable: a short confirmation (or correction) documented back on this issue, and if misconfigured, a follow-up to align branch protection with the single-gate model.

Parent: #2703