land-and-deploy: --required CI gate merges over red/pending CI when no required checks are declared (regression in v1.90.2.0) #2995

Summary

Since v1.90.2.0 (#2972, 7b534d3), /land-and-deploy gates CI only on gh pr checks --required. On a repo that declares no required checks, it treats "no required checks reported" as "nothing to wait for", skips the CI wait, and can merge over red or still-running CI.

Details (read at main 943105f, VERSION 1.91.8.0)

• 7b534d3 changed Step 2 from gh pr checks --json name,state,status,conclusion to gh pr checks "$PR_NUMBER" --repo "$REPO" --required --json name,state,bucket,link. It changed Step 3 from gh pr checks --watch --fail-fast to ... --required --watch --fail-fast --interval 30 (land-and-deploy/SKILL.md:695, :721). The 1.90.2.0 CHANGELOG entry does not mention narrowing the gate.
• SKILL.md:700-701: "An empty successful result or the CLI's explicit 'no required checks reported' response means none are configured."
• Private repos on GitHub Free cannot declare required checks: the branch-protection and rules APIs return 403 "Upgrade to GitHub Pro or make this repository public". Any repo without branch protection has none either. Repro on such a repo:
  • gh pr checks N --required exits 1 with no required checks reported on the '<branch>' branch.
  • gh pr checks N lists the real CI runs.
• Step 3's wait is then skipped. sections/merge-and-deploy.md:59 direct-merges on "Auto-merge is not allowed for this repository" or "Pull request is in unstable status", so red or pending CI can merge. --match-head-commit protects the head, not CI (merge-and-deploy.md:75). statusCheckRollup and mergeStateStatus do not appear in land-and-deploy.
• The readiness report has no CI row. README ("wait for CI and deploy") and docs/skills.md ("monitors CI") promise the skill waits for CI. No doc says the skill requires branch protection or required checks.
• Not a local-config issue: a clean ./setup --team install at the same revision, with no gstack-config key, /setup-deploy Deploy Configuration field or ## Testing block that changes Steps 2-3.

Proposed fix

When --required reports none, or protection metadata is unavailable (403), gate on all checks (gh pr checks / statusCheckRollup), including the watch. Before the DIRECT fallback, re-read mergeStateStatus and stop on UNSTABLE unless the user overrides. #2580 proposed exactly this all-checks fallback, but the shipped version dropped it.

Related: #1970 (the same gh output; that daemon fails closed, and its non-goal is "do not silently treat this as no required checks"), #884 (the same Free-plan gap for reviews).