rev-code-01 review id 215: the branch-protection API is admin-gated for seat
tokens, so 'required status check' cannot be evidenced inline; the comment
states only what carries its own evidence. Protection and default-branch
status are API-readable and stay.
The old comment said push CI is restricted to "protected branches (main)",
which implied next lacked post-merge verification. next is protected and the
default branch since 2026-08-19, and it is not unverified: publish.yml's
verify step runs the complete mandatory set on every push to next, mirroring
this pipeline step-for-step (enforced by verify-release.test.mjs). The
postgres run and push-ci status context it does not re-run duplicate
pre-merge coverage, since PR CI tests the merge ref whose tree equals the
squash commit. Measured 2026-08-19: the 21 most recent push events on next
each ran exactly one pipeline (publish), zero ci. No behavior change.
ops-ci-01