Promote ported governance gates to portico required-status-checks

---
feature_id: FEAT-studio-dependency-map-policy
labels:
  - governance
  - portico
  - ruleset
parent: KNUCK-A045
blocked_by:
  - KNUCK-A045a
  - KNUCK-A045b
  - KNUCK-A045c
---

## Context

After A045a/b/c have merged and each workflow has demonstrated a green run on the port PR itself, update portico ruleset id [REDACTED-MRN] to add the new contexts.

Mirror the SENT-4 rulesets-as-code convention already used on portico:

- Update `.github/rulesets/main-no-agent-admin-bypass.json` to include the new contexts.
- Update or create `scripts/apply-main-ruleset.sh` (portico already has a similar script from SENT-4) to include the new payload.
- Portico uses `~DEFAULT_BRANCH` (not `refs/heads/main`) in the ref condition -- preserve.
- Portico uses `bypass_actors: []` (no admin bypass) -- preserve; this is stricter than studio's admin-bypass allowance.
- Portico uses `required_linear_history: true` -- preserve.

Contexts to ADD (all path-filtered workflows -- verified [REDACTED-DOB] that GitHub's required-status-checks evaluator accepts "no run at all" as fine; only `skipped` conclusion or `failure` blocks merge):

- `Check ticket trailer` (from A045c; runs on every PR unconditionally, no path filter)
- `Reject fabricated verification evidence` (from A045a; unconditional on PRs)
- `Parse inventory and assert declared self-tests exist` (from A045b; path-filtered to guard-inventory doc, script, and check/no workflows)

DO NOT add yet (waits on separate work):
- `Dep Map Rebuild` -- push-only trigger, not PR-eligible until reshape (out of scope)
- `Incremental dep-map rebuild` / dependency-map audit -- studio version blocked on KNUCK-A044 widening; portico version doesn't exist yet

## Acceptance Criteria

- [ ] All three prerequisite tickets (A045a/b/c) have merged
- [ ] PR updates `.github/rulesets/main-no-agent-admin-bypass.json` on portico
- [ ] Apply-script dry-run confirms diff is additive-only (no drop of existing 8 contexts, no change to `bypass_actors`, no change to `required_linear_history`)
- [ ] Admin runs `apply-main-ruleset.sh` (agent PAT lacks repo-admin on portico too)
- [ ] Read-back verifies portico ruleset [REDACTED-MRN] now lists 11 required contexts
- [ ] Synthetic bad PR (scaffolding tripwire hit + no ticket trailer) is refused merge

## Provenance

Parent: KNUCK-A045. Blocks: none.