fix: defer checks from read-only investigation

.github/codex/maintenance/investigation.md

@@ -9,6 +9,11 @@ artifact installation, or readiness state must change. Cite exact public policy
 commit and digests. Do not independently fetch or classify upstream PHP data.
 Return GO only when every criterion passes and unresolved is empty.
 
+Treat `requiredChecks` as downstream exact-head gates, not investigation-phase
+advisory checks. Declare them in the plan, but do not run them in this read-only
+phase or treat their not-yet-run status as unresolved; writable deterministic
+jobs execute them before merge.
+
 The plan must cite each of the four records in `policy-capture.json` exactly
 once. Each evidence item has `captureId`, the captured `digest`, and a
 `locator` with `kind: json_pointer` and a resolving JSON Pointer `value`.

.github/workflows/maintenance-consumer.yml

@@ -75,7 +75,7 @@ jobs:
               actionKey:$actionKey,
               preconditions:{misePhpHead:$misePhpHead,phpBinPolicyCommit:$phpBinPolicyCommit,supportPolicyDigest:$supportPolicyDigest,policyInvariantsDigest:$policyInvariantsDigest,phpBinOperatorCommit:$phpBinOperatorCommit,operatorState:$operatorState},
               allowedAuthority:["read_repository","read_captured_policy"],
-              nonGoals:["upstream_php_classification","repository_mutation","irreversible_github_effect"],
+              nonGoals:["upstream_php_classification","repository_mutation","required_check_execution","irreversible_github_effect"],
               completionCriteria:[
                 {id:"phase-goal-correct",requirement:"The goal matches exact inputs.",evidenceRequired:"Exact preconditions."},
                 {id:"policy-difference-explained",requirement:"Every required local change is bound to captured policy.",evidenceRequired:"Policy digest and JSON locator."},

test/test_maintenance.py

@@ -70,6 +70,19 @@ def test_protected_controls_are_not_admissible(self):
         self.assertTrue(protected("readiness/new-branch.json"))
         self.assertFalse(protected("lib/releases.lua"))
 
+    def test_investigation_defers_required_checks_to_writable_jobs(self):
+        root = pathlib.Path(__file__).resolve().parents[1]
+        instructions = (root / ".github/codex/maintenance/investigation.md").read_text()
+        consumer = (root / ".github/workflows/maintenance-consumer.yml").read_text()
+        self.assertIn("Treat `requiredChecks` as downstream exact-head gates", instructions)
+        self.assertIn("do not run them in this read-only", instructions)
+        self.assertIn("not-yet-run status as unresolved", instructions)
+        self.assertIn(
+            'nonGoals:["upstream_php_classification","repository_mutation",'
+            '"required_check_execution","irreversible_github_effect"]',
+            consumer,
+        )
+
     def test_policy_capture_urls_are_commit_pinned(self):
         sha = "a" * 40
         policy, invariants = pinned_policy_urls(sha)