ci: explain why non-conforming PR head branches exist under the active branch-name ruleset #2569

Goal

Determine why branch names that violate the active branch_name_pattern ruleset were accepted, and make enforcement match what the docs claim.

Background

Ruleset 18969101 ("Base branch naming", active since 2026-07-15, no bypass actors) requires non-default branches to match ^(bug|enhancement|documentation|ci|security)/[1-9][0-9]*-[0-9]{8}-[a-z0-9]+(-[a-z0-9]+)*$. The rules-for-branch API reports that rule as applying to a violating name.

Yet seven of the last forty pull requests had heads that violate it: #2547 ci/2546-fix-release-readiness-list-method, #2535 fix/2534-..., #2522 fix/2520-..., #2511 docs/2507-..., #2501 release/2500-..., #2494 fix/2494-..., and #2487 release/2482-.... All seven were closed unmerged and replaced by a PR from a canonical branch; the closing comment on #2547 cites the Issue Branch Policy workflow rejecting the missing date segment, three others cite a canonical-branch replacement, and three have no comment.

Either the ruleset does not apply on the push path used, or its regex semantics differ from the workflow's. This is the class of gate that goes quiet rather than red.

Next-release planning review of 2026-10-14/15 against main at 7faf6dfb. Tracking: #2555.

Scope

• Reproduce with a throwaway branch with a violating name pushed by git push, by the Git Data API, and by gh; delete it afterwards.
• Compare ruleset semantics with the workflow's pattern and document the cause.
• Fix the configuration, or correct docs/github-workflow.md to state exactly what each layer enforces.
• Add the finding to the gate-canary work if a canary is feasible.

Acceptance Criteria

• The root cause is written in the issue with evidence from each push path.
• Either a violating push is rejected at push time (demonstrated), or the docs state precisely which layer rejects it and when.
• No stale enforcement claim remains in docs/github-workflow.md.

Validation

gh api repos/basefoundry/base/rules/branches/<violating-name>
# throwaway-branch push reproduction transcript, then delete the branch
git diff --check

Non-Goals

• Do not loosen the pattern.
• Do not add bypass actors.

Project Fields

• Status: Ready
• Priority: P1
• Area: CI
• Initiative: Agentic Coding Platform
• Size: S
• Milestone: v1.11.0
• Category: ci

Agent Assignment

Assignee: codeforester. The reproduction creates and deletes one throwaway remote branch; the maintainer authorizes that by filing this issue. Use an issue-backed worktree.