Fix ordered branch exclusions in the selected replay CI guard

[petalas]

Summary

The selected-replay CI guard accepted branches: [main, '!main'] and reported complete trigger coverage, although GitHub excludes main. Reuse the guard's existing ordered glob matcher for branch inclusion, preserving its explicit-main restriction and advisory default.

 branches: [main, '!m*']
- --require-triggers: exit 0, PASS_SELECTED_CI_INPUTS
+ --require-triggers: exit 1, push branch filter excludes main

Add three regression groups and a scoped evidence note. This follows Sagar Thakrar's guard in #1361 and Discussion #2926. The current workflow passes; no missed hosted run is claimed. No construction, source archive, selected record or kappa changes.

Evidence

• Before: the actual guard CLI passes with an edited selected workflow that excludes main. The final regression tests reject the base guard with 22 failing subtests.
• After: the same CLI rejects exclusions for push and pull_request, including under optimized execution. Later re-inclusion passes. Eight CLI controls also verify the advisory default against a complete small repository fixture.
• All 24 focused tests pass on macOS arm64 with Python 3.9.6, 3.12.15 and 3.14.8. Python 3.12 passes with warnings as errors; Python 3.14 passes under -O. Forty related source-binding and replay-bookkeeping tests pass on Python 3.12. The selected-record check and current-tree --require-triggers check pass. Ruff E4/E7/E9/F checks pass, with no additional diagnostics under the broader local configuration.
• A separate read-only review found no correctness issues. Hosted CI, Linux/Windows execution and the complete mathematical cold replay were not run locally. The reader retains its existing static YAML/glob limitations.

python3.12 -W error -B -m unittest discover -s tests -p test_selected_ci_inputs.py -v
python3.14 -I -O -B -m unittest discover -s tests -p test_selected_ci_inputs.py -v
python3.12 -I -B scripts/check_selected_ci_inputs.py --require-triggers
python3.12 -I -B scripts/verify_selected_result.py

Merge Danger

Door: two-way

Blast Radius: tooling

Branch exclusions and unsupported branch globs now produce coverage errors. They fail the command only with --require-triggers. The production correction is two lines; the mathematical replay and frozen evidence are unchanged.