Dev and main require no status checks before merge #78

Problem

dev and main require no status checks before a merge. Both branches have classic branch protection with required pull request reviews, but gh api repos/OpenRAE/workbench/branches/<branch>/protection/required_status_checks returns 404 "Required status checks not enabled" for each, and the repository has no rulesets (gh api repos/OpenRAE/workbench/rulesets returns an empty list; checked 2026-10-12).

So a failing audit, test or sonar job in ci.yml, or a failing PR title guard, does not block a merge into dev or main. #61's first acceptance criterion says that existing required verification coverage remains mandatory before protected-branch integration; today no check is mandatory.

This is a repository setting, so no pull request can change it.

Scope

• Require the CI checks on dev: audit, test, sonar and PR title guard, plus lint once ci: run lint as its own job and spread pytest over the runner's CPUs #73 adds that job.
• Require the same ci.yml checks on main, where the promotion pull request from dev runs them.
• sonar fails on every pull request until ci: SonarCloud rejects the repository SONAR_TOKEN #75 replaces the repository token, so requiring it before then would block every merge.

Done when

• gh api repos/OpenRAE/workbench/branches/dev/protection/required_status_checks lists the CI checks above.
• The same call for main lists the ci.yml checks.

Related

• ci: shorten PR feedback without reducing verification coverage #61 (acceptance criterion 1)
• ci: run lint as its own job and spread pytest over the runner's CPUs #73 (adds the lint job)
• ci: SonarCloud rejects the repository SONAR_TOKEN #75 (SonarCloud token)