docs: record that scan gates acc and main, in the places that said otherwise

[sgort]

scan became a required check in both rulesets today, acc supply-chain gate and main promotion gate. That happened once the Semgrep baseline had been triaged from 86 findings to 5, none of them blocking.

That change touched no file, because a ruleset is GitHub state and not part of the tree. It left four statements saying the opposite:

Where	Said
semgrep.yml header	"NOT yet a required check in either ruleset"
posture page intro	"reporting but not yet required"
posture page summary row	⏳ reporting
posture page §2	"runs it as a reporting check before requiring it"

Left alone, the workflow would tell every reader the scan is advisory while it blocks merges to production. That is the same class of stale label ttl-editor#129 corrected there.

What changed

• semgrep.yml. Only comment lines change, and the file still parses. The header now also says why there is no fork caveat here: this repository has no forks. It points at ttl-editor#128 in case that ever changes.
• SECURITY-PIPELINE.md. Its enforcement section said "the acc ruleset requires … a passing audit check". There are two rulesets and now two checks. A new section, "What the rulesets require", lists both rulesets with their ids, refs, required checks and merge methods.
• Posture page. Intro, summary row and §2 are corrected. §4's account of the main gate, which listed audit as its only check as of 2026-09-09, gains a line recording that scan joined it.

Recorded because the posture page asked for it

The two rulesets differ in one parameter, deliberately. require_extra_approval_for_unattributed_changes is true on acc and false on main. The main ruleset was created without it, GitHub stored it as true, and with no second maintainer to approve, that would have deadlocked the promotion. The posture page said this was worth recording somewhere durable, or it would read as drift.

Both rulesets were written with a full explicit payload and read back afterwards. Each changed in the required-checks field and in no other, and this parameter survived.

The cost: bypass_actors is empty on both. An unreachable semgrep.dev or a revoked token stops merges to main as well as acc, and here that includes promotion to production.

Proven without pushing

#80 was opened before semgrep.yml existed. It now reads blocked, with audit present and scan missing. The four Renovate pull requests that Renovate had already rebased onto the new acc carry a scan run and stay clean.

Verification

check-format and check-supply-chain --offline pass, and zizmor reports 0 findings.