Port guard-inventory self-test to portico (child of KNUCK-A045)

---
feature_id: FEAT-studio-dependency-map-policy
labels:
  - governance
  - portico
  - guard-inventory
---

## Context

Parent tracker: KNUCK-A045.

Port the guard-inventory self-test (studio KNUCK-A032) to portico. Files to copy from operant-health/operant-studio at HEAD as of 2026.09.08:

- .github/workflows/check-guard-inventory.yml (1526 bytes) -- job name is Parse inventory and assert declared self-tests exist
- scripts/check-guard-inventory.ts -- SUT
- docs/knuckles-guard-inventory.md (30 lines) -- source-of-truth inventory

On portico, this requires generating a fresh guard-inventory doc that maps portico .github/workflows/check-*.yml and no-*.yml set:

Portico guards existing:
- check-knuckles-a033-selftest.yml -- has selftest job
- check-org-scoped.yml -- unknown
- check-required-not-skipped.yml -- has selftest job
- sent4-admin-merge-sentinel.yml -- unknown
- rebase-strategy-guard.yml -- unknown
- main-e2e-guard.yml -- unknown

Each entry in the new portico-side guard-inventory doc needs either selftest: yes + a named self-test job, or selftest: no + a KNUCK-A032 gap marker.

## Acceptance Criteria

- PR on portico that copies the workflow + script + a fresh doc for the portico guard set
- Every existing portico check-*.yml / no-*.yml / *-guard.yml / *-sentinel.yml is listed in docs/knuckles-guard-inventory.md
- Every entry either has a working selftest: yes job or a KNUCK-A032 gap marker (with a Ledger followup ticket)
- The workflow runs green on the PR itself
- Follow-up separate PR (KNUCK-A045d) adds the context to portico required-status-checks list

## Provenance

Inventory taken from local studio checkout at /home/user/workspace/operant-studio-work on 2026.09.08.