Require the gate and protected-main policy

Read the actual gate's check context from a run on the installation. Review policy drift without writing:

navigator ops forgejo setup example-firm/sample-litigation \
  --url https://forge.example.test/ --check-context ci --dry-run

Use the observed context in place of ci. The reconciler prepares required checks, signed commits, PR-only changes, administrator enforcement, and squash-only merging. Verify direct pushes, force pushes and branch deletion are denied. The scheduling command requests a governed merge; it does not install an automatic PR scheduler.

CODEOWNERS, trusted check identity, merge-time review-thread enforcement, automatic scheduling, and branch cleanup on closure remain separate migration gates. A successful policy API response does not prove all of them.