fix(ci): main-red alarm was silent on the path that produces nearly every run

[catomean]

The hole

#272 added the red-main alarm on workflow_run. That covers pushes to main — but every merge in this repo is an auto-merge made with GITHUB_TOKEN, which fires no push event. The sweep therefore re-arms ci.yml by dispatch, and GitHub emits no workflow_run event for a dispatched run.

So the alarm was blind on the path that produces almost every main CI run here.

Proven within the hour of merging #272: main went red on a66baa55, the sweep went straight back to refusing to merge onto a broken base, and no issue was filed. (Root cause of that red was transient — puppeteer's postinstall got a 403 fetching chrome-headless-shell — and a gh run rerun --failed cleared it. But nothing told anyone it had happened.)

The fix — dual-path, one policy

Path	Trigger	Caller
push to main	workflow_run	main-red-alert.yml
auto-merge re-arm	dispatched run	ci.yml → post-main job

Both call scripts/ci/main-red-alert.sh, so the two paths cannot drift.

The post-main job is gated to github.ref == 'refs/heads/main' && github.event_name == 'workflow_dispatch', resolves its own verdict from the job results (skipped counts as success, since jobs here are conditional on event type; failure outranks cancelled), and needs only issues: write.

Also: .gitignore had a blanket *.sh

My first push committed the two workflows without the script they call — which would have broken CI on merge. The repo ignores *.sh with a hand-maintained list of per-file negations, so every new CI script needs someone to remember to add one.

Replaced that footgun for this directory with !scripts/ci/*.sh: CI scripts are part of the build contract — workflows call them by path, so a missing one breaks CI rather than merely being absent.

Verification

• Both workflow files parse; ci.yml's original triggers and all six existing jobs are preserved (re-parsed and asserted, not eyeballed).
• bash -n clean on the script.
• Verdict logic unit-tested across the combinations:

success success success success     -> success
success skipped skipped success     -> success
success failure success success     -> failure
success cancelled success success   -> cancelled
failure cancelled success success   -> failure

🤖 Generated with Claude Code