docs: link CI required checks runbook

README.md

@@ -36,6 +36,9 @@ Binding promises between the manifest, demo, services, installer, CI, and docs
 are tracked in [Contracts](docs/contracts.md). Update that registry whenever a
 new invariant becomes part of the reference project.
 
+Maintainers can use the [CI required-checks runbook](docs/ci-required-checks.md)
+when reviewing branch protection and required workflow contexts.
+
 The release-aware view of demonstrated, intentionally omitted, and upstream-
 blocked Base capabilities is maintained in the [Base capability and evidence
 matrix](docs/base-capability-matrix.md). Use it during Base release reviews and

tests/validate.sh

@@ -1419,6 +1419,11 @@ grep -Fq 'docs/contracts.md' CONTRIBUTING.md || {
   exit 1
 }
 
+grep -Fq 'docs/ci-required-checks.md' README.md || {
+  printf 'README.md does not reference docs/ci-required-checks.md.\n' >&2
+  exit 1
+}
+
 grep -Fq 'basectl trust allow base-demo' CONTRIBUTING.md || {
   printf 'CONTRIBUTING.md does not include the manifest trust approval command in useful commands.\n' >&2
   exit 1