[IanFrelinger]

Fixes the three brick findings from the accuracy study in #871 (docs/benchmarks/blockers-accuracy.md on that branch). Allowed through the 0.4.0 freeze by the coordinator. It merges after #866, and #872 rebases onto it afterwards.

What was wrong

Without admin rights, github.blockers 1.0.0 could not read branch protection. On the study's 44 real pull requests:

• F1: it listed every failing or pending check as a blocker, required or not. That gave 16 overcalls on 10 PRs.
• F2: it never named a missing required review. On 24 of 24 PRs it reported only "Required approvals" as unknown.
• F3: it never named a required check that had not run. It missed all 66, or reported "blocked by a branch rule this read could not identify".

Fix (brick 1.1.0)

GitHubBlockerReader now reads the same requirements from sources that need no admin rights:

• Protection summary: GET /repos/{o}/{r}/branches/{base}, field protection.required_status_checks. Enforcement off counts as none.
• Active rulesets: GET /repos/{o}/{r}/rules/branches/{base}, using the required_status_checks contexts and the highest pull_request.required_approving_review_count. These are now also read with admin rights, because classic protection never covered them.
• GraphQL: isRequired(pullRequestNumber:) per check on the head commit, plus the pull request's reviewDecision. Without a token, or on any error, the read falls back.

BlockerAnalysis changes:

• A failing check that is not required is a note ("It is not required, so it does not block the merge.").
• A required check with no run blocks by name.
• When it was read, reviewDecision decides the review blocker. It also covers code-owner and last-push rules that no count shows.
• A ruleset approval count is a lower bound, so the brick blocks on it ("0 of 1 required approving reviews."). Classic protection may require more, so approvals stay an unknown only when nothing settles them.
• The old fallback, where GitHub's mergeable_state decides, now applies only if both public lists fail to read.

Tests

The new tests in GitHubBlockersBrickTests replay facts trimmed from the study's snapshot, through Octokit and the real egress guard with a stub transport:

• F1_… (Compare converted reference-type identifiers by their provider values dotnet/efcore#39369): coverage fails but is not required, so it is a note. The ruleset's 1 approval blocks.
• F2_F3_… (docs(auth): make --with-token scope hint match enforced scopes cli/cli#14816): three required build checks never ran, plus GraphQL REVIEW_REQUIRED. Four named blockers, no unknowns.
• F2_… (Match protocol property names case-sensitively modelcontextprotocol/csharp-sdk#1934): the review is named instead of "an unidentified branch rule".
• Anonymous read (GraphQL 401): the REST lists still decide checks, and approvals stay unknown.
• Analysis: an APPROVED decision settles approvals even when only rulesets gave a count.

GitHubBlockersBrickTests passed 38/38 on both net8.0 and net10.0 in CI.

Mutation checks

Each check ran scripts/mutation-check.sh in the devtest container, in CI, at commit 1201818e5, with filter GitHubBlockersBrickTests:

Mutation	Change	Verdict
f1-nonrequired-check-blocks	if (advisory || (required is not null && !required.Contains(name))) → if (advisory)	KILLED red=failed:3/38 green=passed:38/38
f2-review-decision-dropped	pull?.ReviewDecision → null	KILLED red=failed:1/38 green=passed:38/38
f2-ruleset-approvals-dropped	ruleset required_approving_review_count → 0	KILLED red=failed:2/38 green=passed:38/38
f3-public-summary-not-read	summaryChecks = adminChecks (public branch summary never read)	KILLED red=failed:4/38 green=passed:38/38

A first F3 mutation (if (summaryChecks is null && …)) did not compile because of a nullable error, so its verdict was INVALID; I replaced it with the F3 mutation in the table.

Records touched

• src/Ashlar.Bricks.GitHub/README.md (Known limits)
• docs/EgressInventory.md, row EG-HTTP-08: the GraphQL request body now carries owner, repository and number.
• CHANGELOG.md (Unreleased)
• Knowledge graph regenerated.

scripts/ci/run-repo-gates.sh: all 41 gates pass locally.