Promote path-guard and secret-scan to required branch-protection checks (evidence bar)

[rosscado]

Problem: the path-guard (#530/PR #539) and secret-scan (#531/PR #547) workflows are merged and live but advisory — they only become mechanical guarantees once they are required branch-protection checks.

Scope: branch protection on main (add two required contexts). Out of scope: the workflows themselves (shipped).

Reproduction / verification: gh api repos/Pedal-Intelligence/saypi-userscript/branches/main/protection currently requires exactly test (22.x) + e2e. Verify done = both new contexts required and a live PR blocked/allowed correctly.

Acceptance criteria:

• Each check promoted after meeting the same bar the founder set for the e2e promotion: 5 consecutive first-attempt-green runs on distinct non-docs-only PRs, zero harness-caused flakes (bootstrap-skip runs of path-guard don't count toward the 5).
• Promotion executed via branch protection + the workflow/docs updated to drop 'advisory' wording in the same change.
• Note: Governance: define the release-gate relaxation criteria (staged release delegation) #523's accepted Stage 2 bar requires secret-scan promoted; Stage 3 requires path-guard promoted covering .github/workflows/** + scripts/release* — so these promotions gate the release-delegation stages.

Notes (non-binding): requesting the same delegation as the e2e precedent — founder pre-authorizes the agent to execute the promotion itself once the bar is verifiably met (grant recorded here if given).