CI: required checks can never report — ABI Contract / Cross-Platform startup_failure (setup-zig not allow-listed); K9 + Sonar red on main

[hyperpolymath]

Problem

main (070529e) cannot produce the checks its own ruleset requires. No PR can therefore satisfy the required-status-checks rule, and auto-merge can never fire.

1. Required-check producers never start. The ruleset requires Linux, Idris2 model type-checks, Zig ↔ Idris tables in sync and AffineScript ↔ Zig FFI symbols in sync. They come from the Cross-Platform Build & Test and ABI Contract workflows. Both end in startup_failure on main 070529e and on PR fix(launcher): regenerate game-server-admin launcher with the XDG pid/log ladder #102, so they create no check runs at all. Governance, GitHub Pages and Mirror to Git Forges also end in startup_failure on main. The run pages for ABI Contract (run 35609965294) and Cross-Platform (run 35609970129) give the cause:

   The action mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 is not allowed in hyperpolymath/game-server-admin because all actions must be from a repository owned by hyperpolymath, created by GitHub, or verified in the GitHub Marketplace.
   

   The cure is to allow-list mlugg/setup-zig (at the pinned SHA) in the repo or org Actions policy, or to replace it with an allowed Zig setup. Weakening the policy estate-wide is not the cure.
2. Dogfood Gate / Validate K9 contracts fails on main and on PRs:

   Validating: ./container/deploy.k9.ncl
   ##[error]Pedigree block missing 'name' field (in pedigree.metadata.name or pedigree.name)
   ##[error]K9 validation failed with 1 error(s)
   

3. SonarCloud Code Analysis and Hypatia Security Scan fail on main 070529e.

Acceptance criteria

• Cross-Platform Build & Test and ABI Contract start on a PR and on main, with no startup_failure. Each of the four required contexts appears on the PR head as a real check run. The fixing PR names the startup error text from the run page.
• Governance, GitHub Pages and Mirror to Git Forges no longer end in startup_failure on main.
• container/deploy.k9.ncl carries a pedigree name (and version/schema_version), and Validate K9 contracts is green on main.
• SonarCloud Code Analysis is green on main, or is removed with a stated reason.
• The required-context set in the ruleset is SET-EQUAL to the contexts an actual PR head produces.

Found while landing #102. #102 inherits these reds and does not cause them. Its auto-merge (squash) is armed and will stay parked until item 1 is fixed.

[hyperpolymath]

Item 1 (required-check producers): fixed by #104, merged 2026-09-30T15:19Z as ec5db2f. The owner ruled to swap the action, not to change the allow-list.

• mlugg/setup-zig is replaced by scripts/install-zig.sh. It fetches the official ziglang.org Zig 0.15.2 x86_64-linux tarball and checks it against a pinned sha256. At pin time the tarball's minisign signature was verified against the ZSF key. No third-party action is used. The Actions allow-list is unchanged.
• In actions.lock, the three mlugg/setup-zig@v2.2.1 entries were removed by hand. gh actions-lock --no-fix reports valid.
• PR head fbd8151 ran ABI Contract (run 36735322502) and Cross-Platform Build & Test (run 36735322301). Both concluded success, with no startup_failure and every step executed. All four required contexts ran as real check runs, and all four passed: Linux 109955370259, Zig ↔ Idris tables in sync 109955371714, Idris2 model type-checks 109955372159, AffineScript ↔ Zig FFI symbols in sync 109955371947.
• Rule-suite 4298237478 for the merge push shows every rule pass, with no bypass: required_status_checks, required_signatures, non_fast_forward and deletion.

Still open here and not touched by #104:

• Governance still ends in startup_failure (run 36735326413 on the PR). Pages and Mirror were not re-checked.
• K9 Pedigree block missing 'name' field is still red on the PR (Dogfood Gate run 36735322245).
• Sonar and Hypatia on main were not examined.
• The criterion that the ruleset be SET-EQUAL to the contexts a PR head produces holds for the four required contexts, as observed on fix(ci): install Zig from a pinned, verified tarball — replaces non-allow-listed mlugg/setup-zig (#103) #104.

[hyperpolymath]

Confirmed on main at ec5db2f (push event): ABI Contract run 36735829015 and Cross-Platform Build & Test run 36735829299 both concluded success. Governance (36735833054), Mirror to Git Forges (36735834472) and GitHub Pages (36735836472) still end in startup_failure, and Dogfood Gate (36735828996) is still red on K9. Those items stay open.