fix(ci): keep draft-mode success from standing as a ready PR's proof

[schlessera]

Closes #2363

What changed

A ready PR could have a passing proof check that came from a draft run with every product job skipped. Draft runs can no longer produce that check.

• Distinct check name. The aggregate job now reports as draft gates for a draft payload, proof for other pull-request payloads, and integrated or exhaustive proof otherwise (.github/workflows/ci.yml). A proof row on a PR therefore only comes from ready feedback, which fails by design, or from confirmation. The workflow guard pins the new expression and rejects dropping the draft branch (scripts/check-ci-workflows.ts).
• Live readiness check. The draft cadence now reads the live PR through the existing read-only client. It fails with the confirmation-required action when the PR is ready, closed, at another head, or in a malformed state. If the read fails or no token is available, it fails closed (requireLiveDraft, scripts/candidate-proof.ts).
• Producer audit. ci.yml is a pinned generated-CSS producer. Under test(ci): freeze audited generated stylesheet fixtures #2388's ruling, legitimate drift requires fresh proof and does not redefine the audit, so its digest in scripts/generated-build-inputs.ts stays at the audited value. Generated-CSS binding falls back to fresh proof until a re-audit; #2408 asks how that should happen.
• Docs. docs/decisions/ci-utility.md (Scheduling and selection) and the work-issue merge reference describe both mechanisms, including that the live read only fails when it observes readiness.

Why

In #2359, a draft push and ready_for_review happened 2 s apart. The draft run was queued second, cancelled the confirmation run through the per-PR concurrency group, and passed proof on a ready PR. The full reconstruction is in the issue. Under the 2026-10-14 cadence ruling, a ready PR's proof must not pass without confirmation.

Either mechanism alone leaves a gap:

• Live check alone: it reads a snapshot. A PR marked ready after that read could briefly show a passing proof.
• Rename alone: an inverted queue leaves no proof row at all, with no visible failure.

Together:

• Admission: a draft success never counts as proof.
• Signal: a draft run whose read finds the PR ready fails visibly.

A cancelled confirmation still shows as a missing proof, which the merge procedure already treats as not green.

Validation

• bun run check:pr --base origin/main at dbec504b2 on c4d31c6bd: 959 fast tests and 78 affected tests, all passing. bun run lint is clean; tsc --noEmit exits 0.
• Focused tests: tests/candidate-proof.test.ts has 5 passing tests; the producer-closure, workflow, hosted-proof and citation suites pass 196 with 0 failures; tests/inclusion-inputs.test.ts passes 11.

Mutation receipts. Each mutation was applied alone, the named test failed, and the source was restored byte-identically (cmp):

Mutation	Fails at
Remove the draft dispatch in validateCandidate	tests/candidate-proof.test.ts:43, the live-ready rejection (receipt taken at 2e0e1d140)
Restrict the guard to synchronize	tests/candidate-proof.test.ts:44
Drop the missing-head identity check	tests/candidate-proof.test.ts:53
requireCandidate no longer calls validateCandidate	tests/candidate-proof.test.ts:55
requireCandidate builds no API client	tests/candidate-proof.test.ts:87, the present-token read
State check weakened to === "closed"	tests/candidate-proof.test.ts:53, malformed state
Drop the draft gates branch from the job name	the guard test in tests/ci-workflows.test.ts, "must not impersonate candidate confirmation"

Independent review: two read-only gpt-6-astra passes.

• First pass: it found the snapshot race and gaps in the tests, which led to the rename and the extra tests.
• Second pass: it confirmed the expression's semantics against proofCadence, found no other consumer of the proof display name, and verified the digest. Its remaining mutation and doc findings are fixed in 97a544351.

Hosted proof: this PR's own ready run is the confirmation. A draft run of this branch would show draft gates.

Gaps

• A mutation that removes the aggregate's existing await requireCandidate(...) call survives. A spawned-aggregate control timed out on hosted unit (3) in run 39083242416, because it plans the repository twice. A cheap version needs the aggregate to validate the candidate first, which changes pinned producer bytes owned by ci: native diagram qualification self-test rejects legitimate source drift #2365's fixture; #2400 tracks it.
• After merge, the generated-CSS binding is disabled until the producer set is re-audited (ci: establish post-merge re-audit procedure for generated-CSS producers #2408); proof runs fresh in the meantime.
• Historical checks from older workflow definitions keep their old names.
• No live GitHub reproduction of the inverted queueing was attempted; it relies on GitHub's scheduler timing.

No changeset: no shipped package files changed.

🤖 Generated with Claude Code