fix: defer checks from read-only investigation

.github/codex/maintenance/investigation.md

@@ -38,6 +38,11 @@ Return GO only when the action is unambiguous, all criteria passed with
 resolving evidence, preconditions remain exact, and unresolved is empty.
 Otherwise return `blocked` or `needs_human` and NO-GO. Make no edit.
 
+Treat `requiredChecks` as downstream exact-head gates, not investigation-phase
+advisory checks. Declare them in the plan, but do not run them in this read-only
+phase or treat their not-yet-run status as unresolved; writable deterministic
+jobs execute them before merge.
+
 If changed evidence has no maintenance consequence, use action `no_change` and
 the key `no_change:<first 16 hexadecimal characters of the evidence manifest
 digest>` so the reviewed snapshot remains uniquely auditable.

.github/workflows/maintenance-watch.yml

@@ -78,6 +78,7 @@ jobs:
             --allowed-authority read_captured_evidence \
             --allowed-authority allowlisted_web_search \
             --non-goal repository_mutation \
+            --non-goal required_check_execution \
             --non-goal irreversible_github_effect \
             --stop-condition missing_or_contradictory_required_evidence \
             --stop-condition changed_precondition \

tests/test_maintenance.py

@@ -147,6 +147,20 @@ def test_investigation_evidence_references_are_machine_resolvable(self):
             self.assertIsNotNone(COMPLETION_EVIDENCE_REF_RE.fullmatch(reference))
         self.assertIsNone(COMPLETION_EVIDENCE_REF_RE.fullmatch("watch-decision.json reports success"))
 
+    def test_investigation_defers_required_checks_to_writable_jobs(self):
+        root = pathlib.Path(__file__).resolve().parents[1]
+        instructions = (root / ".github/codex/maintenance/investigation.md").read_text()
+        watcher = (root / ".github/workflows/maintenance-watch.yml").read_text()
+        self.assertIn("Treat `requiredChecks` as downstream exact-head gates", instructions)
+        self.assertIn("do not run them in this read-only", instructions)
+        self.assertIn("not-yet-run status as unresolved", instructions)
+        self.assertIn(
+            "--non-goal repository_mutation \\\n"
+            "            --non-goal required_check_execution \\\n"
+            "            --non-goal irreversible_github_effect \\",
+            watcher,
+        )
+
     def test_deterministic_evidence_state_shape_is_fail_closed(self):
         capture_ids = (
             "php_supported_versions",