feat(pr-status): name the required checks that never reported

[CybotTM]

The dead end

BLOCKED with no failing check, no open thread and no missing review currently ends at NEXT: investigate — check branch protection manually.

That is the signature of a required context which never reported at all. The status rollup only lists checks that ran, so the PR page shows nothing but green — there is no red thing to look at, and mergeStateStatus alone never says which context is missing. Hit three times in one session — t3x-nr-repurpose#70, t3x-nr-mcp-agent#92, t3x-cowriter#134 — each answered by hand-diffing the ruleset's required contexts against the reported check-runs.

Two causes, both mechanical

• Workflows never dispatched. Common after an Actions incident, or after a force-push during one. gh run list for the branch shows nothing at all. Close+reopen re-fires the pull_request events without adding a commit.
• Fork PR awaiting approval. Runs sit at completed/action_required and need approving once per push. Until then the PR shows a misleadingly small green set: cowriter#134 displayed 5 passing checks of 88, and approving them immediately exposed a Rector failure and eight failing unit cells. A fork PR's green is not green until approved.

The change

Both inputs were already collected — $required from the rules endpoint, $checks from the rollup — so the diff costs no extra API call. The verdict now names them:

NEXT: await-checks — 7 required check(s) never reported — All security checks, CodeQL, Opengrep OSS, betterleaks, ci / All CI checks, scorecard, zizmor. Nothing is red; they were never dispatched, or this is a fork PR whose runs need approving (once per push)

undispatched is also exposed in --json next to the other check facts. This follows the fix-signatures precedent immediately above it, added for the same reason: a gate GitHub reports only as mergeStateStatus, with no red check to find.

Verified

• the jq diff reproduces exactly the seven contexts hand-derived from repurpose#70 at the time
• no regression: merged PRs still answer none — PR is MERGED, and undispatched is [] on a clean PR
• bash -n clean — the cmd string deliberately carries no single quotes, the trap the neighbouring fix-signatures comment already documents

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.