Merge branch 'main' into fix/ci-required-drift-polling-sentinel

`all-required` sentinel intentionally has no `needs:` (Gitea 1.22.6
polling pattern — cannot use `if: always()` + `needs:` because Gitea
1.22 marks `skipped != success`). When `sentinel_needs()` returns
empty, the prior F1 check computed `jobs - set()` = all 5 CI jobs,
producing a spurious "missing from sentinel needs" finding on every run.

Skip F1 when `needs` is empty; the polling-pattern absence is intentional.
Add a `::notice::` line so operators can confirm the sentinel type
without reading the script.

Refs: mc#1207, mc#1208

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/scripts/ci-required-drift.py

@@ -384,12 +384,22 @@ def detect_drift(branch: str) -> tuple[list[str], dict]:
     contexts = set(protection.get("status_check_contexts") or [])
 
     # ----- F1: job exists in CI but not under sentinel.needs -----
-    missing_from_needs = sorted(jobs - needs)
-    if missing_from_needs:
-        findings.append(
-            "F1 — jobs in ci.yml NOT under sentinel `needs:` (sentinel doesn't gate them):\n"
-            + "\n".join(f"  - {n}" for n in missing_from_needs)
+    # Gitea 1.22.6 polling sentinel pattern: `all-required` intentionally
+    # has no `needs:` (polls CI status directly via API). When needs is
+    # empty, all 5 CI jobs would appear "missing" — a false positive.
+    # Skip F1 when sentinel has no needs; the absence is by design.
+    if not needs:
+        sys.stderr.write(
+            f"::notice::sentinel '{SENTINEL_JOB}' has no `needs:` — "
+            "Gitea 1.22.6 polling pattern; skipping F1.\n"
         )
+    else:
+        missing_from_needs = sorted(jobs - needs)
+        if missing_from_needs:
+            findings.append(
+                "F1 — jobs in ci.yml NOT under sentinel `needs:` (sentinel doesn't gate them):\n"
+                + "\n".join(f"  - {n}" for n in missing_from_needs)
+            )
 
     # ----- F1b: needs lists a job that doesn't exist (typo) -----
     # Compare against jobs_all (incl. event-gated jobs); a typo is a