[Security] Fail closed when Strix produces no authoritative scan evidence

[seonghobae]

Problem

A Strix provider/backend outage can currently leave the required workflow in a skipped or neutral-success shape without authoritative scan evidence. GitHub may treat successful, skipped, or neutral required-check conclusions as satisfying the check name, so transport/provider availability can be confused with security success.

Required contract

A mandatory security gate passes only when authoritative Strix evidence is present for the exact source head and relevant live-base context. Provider/tool unavailability is a typed deferred or failing state, never scan success.

Acceptance criteria

• Add a terminal always-running gate that evaluates every prerequisite and exact-head Strix receipt.
• Missing, skipped, neutral, cancelled, action-required, predecessor-head, synthetic, or untrusted-producer evidence is non-passing when Strix is required.
• Retry only classified transient provider failures within attempt and wall-clock budgets.
• Preserve useful bounded diagnostics while applying publication-boundary credential redaction.
• Tests cover provider outage, empty output, skipped job, neutral conclusion, timeout, stale head, fallback exhaustion, and valid current-head finding/no-finding evidence.
• Ruleset documentation names the expected check source/producer.
• Protected-main consumer evidence demonstrates both fail-closed outage and recovery.

Related work

Coordinate log redaction with #842 and retry policy with ADR-0003.