fix(ci): carry the trusted-bot bypass to check, which never had it

.github/workflows/check-now-freshness.yml

@@ -35,8 +35,34 @@ on:
 jobs:
   check:
     runs-on: ubuntu-latest
+    # THE BYPASS THAT WAS NEVER CARRIED HERE. #1081 gave `check-now-freshness` and
+    # `check-linked-issue` a trusted-bot no-op on 2026-06-14, for a reason stated there:
+    # a SKIPPED required check never satisfies branch protection, so the bypass has to be
+    # a step that passes, not a job that is skipped. This job was exempt from the problem
+    # only because its entire body was `echo "Checking repository freshness..."` -- its
+    # blindness WAS the bypass. #2756 gave it real work on 2026-08-28 and the exemption
+    # went with the blindness.
+    #
+    # MEASURED, 2026-09-06: eight open Dependabot pull requests. The three opened
+    # 2026-09-01, after this job got teeth, are RED on `check` and green on the other
+    # three required contexts. The five opened 2026-08-24 are green only because their
+    # last run predates the change; any synchronize or title edit re-runs the job and
+    # flips them. The ruleset is not editable and there are no bypass_actors, so a red
+    # `check` means the pull request can never merge.
+    #
+    # The failure text even asserts what is false on this population: "NOW Sync Gate
+    # should have caught that first" -- on a bot pull request NOW Sync Gate deliberately
+    # does not look.
+    env:
+      IS_BOT: ${{ (github.actor == 'dependabot[bot]' || github.actor == 'github-actions[bot]' || github.event.pull_request.user.login == 'dependabot[bot]' || github.event.pull_request.user.login == 'github-actions[bot]') && 'true' || 'false' }}
     steps:
+      - name: Trusted-bot bypass (no-op pass)
+        if: env.IS_BOT == 'true'
+        run: |
+          echo "Trusted bot PR -- gate passes as no-op. Closes 1031."
+
       - uses: actions/checkout@v6
+        if: env.IS_BOT != 'true'
         with:
           fetch-depth: 0
 
@@ -56,9 +82,11 @@ jobs:
       #     NOW Sync Gate  ->  "you wrote one"
       #     this           ->  "what you wrote says something"
       - name: Negative control
+        if: env.IS_BOT != 'true'
         run: python3 tools/check_now_entry_shape.py --self-check
 
       - name: The docs/now/ entry this PR adds must say something
+        if: env.IS_BOT != 'true'
         env:
           PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
           PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
@@ -78,11 +106,13 @@ jobs:
       # the two readers cannot drift into two rules; if they cannot be read the step
       # exits 2, which is could-not-run and not a pass.
       - name: Negative control for the fix( guard
+        if: env.IS_BOT != 'true'
         run: python3 tools/check_fix_carries_source.py --self-check
 
       # PR_TITLE is attacker-controlled text and reaches the script through the
       # environment, never through `${{ }}` interpolation into a shell line.
       - name: A fix( in a compiler scope must carry a source file
+        if: env.IS_BOT != 'true'
         env:
           PR_TITLE: ${{ github.event.pull_request.title }}
           PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}

docs/now/2026-09-05-check-blocks-every-dependabot-pr.md

@@ -0,0 +1,21 @@
+# NOW -- check blocks every Dependabot PR (2026-09-05)
+
+## check blocks every Dependabot PR (Refs #3335)
+
+- The required context `check` has no trusted-bot bypass: IS_BOT appears 0 times and no
+  step is conditional. Its two neighbours have 6 and 3.
+- #1081 gave those two the bypass on 2026-06-14, and stated why it is a no-op PASS step
+  rather than a skipped job: a skipped required check never satisfies branch protection.
+- This job was exempt only because its whole body was an `echo`. Its blindness WAS the
+  bypass, and when #2756 gave it real work the exemption went with the blindness.
+- Measured: eight open Dependabot pull requests. The three opened after the change are RED
+  on `check` and green on the other three required contexts. The five opened before are
+  green only because their last run predates it; a synchronize or a title edit flips them.
+- The ruleset is not editable and there are no bypass_actors, so red `check` means never
+  merges.
+- The failure text asserts what is false on this very population: "NOW Sync Gate should
+  have caught that first" -- on a bot pull request NOW Sync Gate deliberately does not look.
+- Ported character for character; the expression is now identical in all three files,
+  checked rather than assumed.
+- Found by an adversarial pass over the four required contexts: 8 candidates, 6 survived
+  refutation, 2 refuted. The other five are recorded for the next pass.

tools/census/quiet.txt

@@ -2,7 +2,7 @@ GATE STEPS WHOSE PASS SURVIVES THE SUBJECT GOING MISSING
 
   workflow files read           50
   steps in a quiet shape        31
-  named a path but not quiet    127   (--excluded prints them)
+  named a path but not quiet    128   (--excluded prints them)
 
   by shape:
     failure branch passes       15   `… 2>/dev/null … || echo PASSED`

tools/census/shell.txt

@@ -2,10 +2,10 @@ WHICH INTERPRETER EACH GATE STEP IS HANDED TO, AND WHO SAYS SO
 
   workflow files read           50
   jobs                          71
-  run: steps                    234
+  run: steps                    235
 
   who names the shell:
-    the runner does             213   no container, so bash -eo pipefail
+    the runner does             214   no container, so bash -eo pipefail
     a `shell:` key does         0
     NOBODY                      21   a container and no `shell:` key