A failed weekly self-scan has to be visible

[bkd-dotcom]

#106 fixed why the weekly governed self-scan was failing. This fixes why nobody knew — the more interesting half.

The scan failed on 2026-08-17, 2026-08-24 and 2026-08-31 — three consecutive Mondays — and was only discovered because a human went looking at the run list.

A scheduled job that fails silently is indistinguishable from one that never ran. Treating an absent signal as a passing one is precisely the mistake this engine exists to catch, and it should not have been our own weekly job doing it.

What changes

A notify job, 50 added lines, nothing removed. A failing scheduled run files a report.

decision	why
schedule only	A failed workflow_dispatch is already in front of the person who clicked it. Filing an issue at them is noise — and noise is how the first three failures got ignored.
One issue, reused	A fresh issue every Monday would bury the signal it exists to raise. An already-open report gets a comment.
Label created first	gh issue create --label fails outright on a label that doesn't exist.
issues: write, job-scoped	This job gets nothing else — notably not the contents/pull-requests write the scan job holds.

The report says plainly that no fix PRs were opened and nothing was merged, so reading it can't leave anyone wondering whether a half-finished change landed.

Verification

The fix in #106 is already proven, not just merged — a workflow_dispatch on 14d2aff ran green through all seven steps including Install Signetry, the step that was failing, and the scan and PR steps after it. The next scheduled run (Mon 07 Sep) will be the first scheduled green one.

This PR cannot be verified the same way, because it only runs when the scan fails. notify is unreachable on a green run by construction. What is checked here is that the YAML parses and the job wiring is right: needs: autofix, if: failure() && github.event_name == 'schedule', permissions: {issues: write}.

[github-actions]

Signetry Reviewer — 🟣 Escalate to a designated reviewer

Escalate to a designated reviewer — this PR touches security-sensitive surface (.github/workflows/signetry-autofix.yml). No blocking issue was found automatically, but a human owner should sign off.

Deterministic gates (the authority)

Gate	Status
Required status check	⏳ pending
Secret scan	✅ clean
CI permission / OIDC	✅ no forbidden change
Dependency skew	✅ ok
All green	❌

Findings (1, 0 blocking)

• 🟡 Change touches a protected path: .github/workflows/signetry-autofix.yml .github/workflows/signetry-autofix.yml (via cross-check)
  • .github/workflows/signetry-autofix.yml matches a protected pattern (.github/workflows/*). Changes here alter shared/foundational surface and warrant a designated reviewer.
  • Fix: Route to a code owner / architecture reviewer.

Sensitive surface

This PR changes security-sensitive paths that warrant a designated reviewer:

• .github/workflows/signetry-autofix.yml

Merge

A designated reviewer / code owner should sign off before merge (sensitive surface).

This review is advisory. It never merges on its own judgement — the deterministic gates + a human are the authority. Findings can have false negatives; a green bot verdict is not a guarantee.