feat: own per-repo required-check contexts as reviewable config, with a requirability standard and potency lint #65

What

Make each repo's required status-check contexts temper-owned, reviewable config instead of hand-applied direct-API state — the per-repo escape hatch the empty org floor (config.yml, 2026-05-10 audit; #57) always assumed, but which today nothing applies, records, or audits.

Three parts:

1. Config-as-code: a per-repo required_contexts map in temper config (or a file temper reads from each repo). Changes become diffs, not undocumented API mutations. Direct ask from ordeal: their 8→7 gate change "was a direct-API mutation recorded only in PR prose."
2. A requirability standard, enforced by temper when applying the list. From the feedback round, a context is requirable only if it always reports under a stable name:
   • never a matrix-expanded name (Test + Lint (ubuntu-22.04)) — renaming the matrix deadlocks every PR; cost varve a merge, flagged independently by gale and meld;
   • never a path-filtered workflow — it never creates its check and blocks forever (9 of gale's 18 PR workflows, including formal-verification);
   • prefer a fixed-name aggregator job (needs: [...] + if: always(), fail unless success) — varve's mutants-gate and meld's Mythos delta-pass gate are the working pattern;
   • a required context must not target a runner label with fewer than two online runners (synth: a dead one-runner pool made the whole repo un-mergeable).
3. A potency lint: flag any required context that no branch of current CI produces (catches the whole class above), and — per temper#61 §1.1 — flag repos whose workflows produce named checks while no required_status_checks rule exists.

The per-repo lists, already supplied by the repos

• jess (#201) — currently required: none. Wants exactly 5 (verbatim): rivet validate (artifact spine), spar model (Pixhawk 6X-RT), mav_bench oracle (REQ-PIX-010), Renode RT1176 smoke (REQ-PIX-005), scry sound-analysis (REQ-PIX-018 / TEST-PIX-022) — with strict: true. "If only one thing lands, it is this pair."
• gale (#323) — currently required: none; 11 stable names listed in the issue; matrix and path-filtered ones excluded until converted (gale#319 pattern).
• varve (#121) — has 14 via its own ruleset; 7 systest contexts missing (verbatim list in issue) — the system-level gates that caught every recent real defect are the unrequired half.
• ordeal (#130) — 7 today via direct API; add CaDiCaL backend (cadical feature); deliberately not required: Z3 oracle, Bazel, fuzz smoke. (Also: drop retired Kernel model drift from any inventory.)
• meld (#391) — 5 today; add Release readiness first (v0.51.0 and v0.52.0 were tagged while it exited 1), then Scry, Witness MC/DC, Coverage, Bench compile-only; fuzz-smoke stays out until the runner fleet is stable.
• synth (#1132) — 9 today, correct set, add none.

Longer-term

The starter-workflow floor via pulseengine/.github (already named in config.yml's comment) remains the vehicle for a real org-wide minimum; this issue is the per-repo half that unblocks today.

From the 2026-09 org feedback round (temper#62); builds on temper#61 §1.1.