Merge branch 'main' into fix/ci-required-drift-1739

Adds `sop-checklist / all-items-acked (pull_request)` to REQUIRED_CHECKS
env so the audit correctly fires for PRs merged without an SOP ack
(e.g. admin override on a low-tier PR).

Addresses F3a from auto-filed [ci-drift] issue #1738:
- audit-force-merge.yml had sop-checklist but branch protection didn't.
- Now both reference the same required-check set.

Note: F3b (protection has E2E contexts not in audit env) requires
admin write on branch_protections/main — tracked separately.

.gitea/workflows/audit-force-merge.yml

@@ -56,4 +56,5 @@ jobs:
             CI / all-required (pull_request)
             E2E API Smoke Test / E2E API Smoke Test (pull_request)
             Handlers Postgres Integration / Handlers Postgres Integration (pull_request)
+            sop-checklist / all-items-acked (pull_request)
         run: bash .gitea/scripts/audit-force-merge.sh