license-scan: the deny step can fail the night job, which then files its one issue (PMAT-2177)

[noahgift]

Refs #2177. A follow-up from the #2176 seat reviews.

Change. license-scan's cargo deny check licenses bans sources step no longer has continue-on-error: true, so a deny finding fails the job. The job was already night-only (schedule || workflow_dispatch) and already ends with the night-issue step, so a red now files its one issue. That is the two-state CI rule: a check either can fail or does not run on the PR path, with no advisory third state.

• license-scan is not a required check. The rules on main require only gate and workspace-test.
• New test no_step_in_a_night_job_has_continue_on_error in night_checks_off_pr_path.rs. It fails on main 850ffff, naming exactly this step.
• Expected on the first scheduled night: main exits 4 on licenses today, with the nine rejections NOTICE.md lists (5 malachite LGPL-3.0-only, 2 foldhash Zlib, hexf-parse, tiny-keccak CC0-1.0). The night will open night: license-scan red on main and keep it open until those are resolved. That is the intended result, not a regression.

Evidence

• t2build: night_checks_off_pr_path 11/11, dependency_license_policy 8/8, ruleset_drift 5/5; fmt and clippy clean through the repo hooks.
• Quorum bound to 9be6262: 3/3 PASS (sonnet-5-5, haiku-4-5, gemini-3.8-flash-high).
• Planted control (continue-on-error put back): 3/3 FAIL, all citing the planted line.
• The reducer marks both rounds partial=true (exit 1). Its only reason is one notice line that the agy lane's own wrapper writes to stderr. The lane exited 0, ran nothing, and its tree witness matched. It is disclosed here rather than edited, and it is filed as a reducer defect.

🤖 Generated with Claude Code

[noahgift]

APPROVE — seat 1, aprender-a7, head 9be6262

Read the full diff at 9be6262 (ci.yml, dependency_license_policy.rs, night_checks_off_pr_path.rs, roadmap). CI is green on this head: gate and workspace-test both pass.

• license-scan's cargo deny check licenses bans sources step loses continue-on-error. A deny finding now fails the night job, and its last step files or updates the one issue. That closes the gap noted on #2176.
• The new test no_step_in_a_night_job_has_continue_on_error checks both the job and every step of each night job. A job counts as a night job if it is on the advisory marker or carries the night if:. The doc comment names the pre-change tree on which the test would be red.
• license-scan stays a night job: it keeps its job-level if:, is not in the required set, and no required job needs: it.
• The comments in the test and ci.yml are updated to match; none still claims the raw step is exempt.

Expected effect: the old comment said the deny check exits 4 today. If that still holds, the first scheduled night opens night: license-scan red on main and later nights comment on it. That is the one-issue LAB behaviour this change is meant to produce.

[noahgift]

seat 2, aprender-clerk @9be6262ea0 — APPROVE

Reviewed 9be6262; no commits of mine. Required gate and workspace-test are green on this head.

• ci.yml: license-scan's cargo deny check licenses bans sources step loses continue-on-error. The job stays night-only (schedule || workflow_dispatch), is not a required check, and ends with the night-issue step, so a deny finding now fails the job and files its one issue. This addresses my #2176 note.
• night_checks_off_pr_path.rs::no_step_in_a_night_job_has_continue_on_error checks job level and every step of each night job (advisory-listed OR carrying the night if:). The PR body records it red on 850ffff, naming exactly this step.
• dependency_license_policy.rs: the docs and assertion message are updated, and the tripwire assertion is unchanged.

Non-blocking: main exits 4 on licenses today, so this job will be red every night until the LGPL owner decision, and each night adds a "Still red" comment to the one issue. That is intended by the PR, but expect one comment per night on that issue.