feat(OMN-14858): wire required-check skip-vector guard into omnibase_compat

[jonahgabriel]

Summary

Fan-out of the required-check skip-vector guard (OMN-14854, omniclaude canary, merged omniclaude#1917) into omnibase_compat — the first fan-out repo after the canary.

• .github/workflows/required-check-skip-guard-caller.yml: local caller invoking the canonical reusable workflow (OmniNode-ai/omniclaude/.github/workflows/required-check-skip-guard-reusable.yml@dev) on every pull_request + merge_group. No paths:/paths-ignore: filter — this is the one required-check workflow that must never be dodgeable by a path filter (design spec §4c).
• .github/required-checks.yaml (schema v3): generated from the LIVE omnibase_compat dev branch protection — gh api repos/OmniNode-ai/omnibase_compat/branches/dev/protection/required_status_checks --jq '.contexts', 21 contexts, fetched 2026-07-20. Every context resolved to its producing job/caller using the same context->job algorithm the validator itself uses (_workflow_model.py::resolve_context_to_job), not guessed.
• One pre-existing real finding surfaced: schema-compat job in .github/workflows/onex-schema-compat.yml (required context "ONEX Change Control Schema Compatibility") has a job-level if: referencing github.event.pull_request.head.repo.full_name (an ordinary fork-vs-same-repo guard) — the classifier treats any github.event.* reference besides .repository/.action as UNGUARDED_CONDITIONAL (vector-2), no partial credit. Documented with skip_semantics: neutral_ok + rationale, tracked in OMN-14862 (mirrors OMN-14856's disposition for the omniclaude canary's own findings — not remediated here).

Local validator run (validate_no_required_check_skip_vectors.py against this manifest + these workflows): PASS: no required-check skip vectors found.

Known blocker: the new guard check itself is red (non-required, documented)

The @main ref for the reusable workflow 404s — omniclaude's main has not yet been promoted past OMN-14854 (verified: main 404s, dev 200s on raw.githubusercontent.com/.../required-check-skip-guard-reusable.yml). Fixed the caller side by pinning to @dev instead (commit e0f373f), but that surfaced a second, upstream defect: required-check-skip-guard-reusable.yml's own "Fetch validator (omniclaude canonical source)" step also hardcodes ref: main for its cross-repo checkout of the validator scripts, independent of the ref the caller used to reach the reusable workflow itself. That 404s the same way, so the validator script is missing and the job fails on python: can't open file ... [Errno 2] No such file or directory.

Filed as OMN-14868 (blocks every fan-out repo, not just this one — OMN-14857's omnimarket fan-out will hit the identical wall). Not fixed in this PR — out of scope for omnibase_compat, needs an omniclaude-side fix (parameterize the fetch-step ref).

This does not block this PR. required-check-skip-guard / check-skip-vectors is mode: ADVISORY in the manifest and is not in required_status_checks — its red state is informational only. All 21 real REQUIRED contexts on this PR are green.

Explicitly NOT done in this PR (scope matches OMN-14854 / OMN-14857 ordering)

• Branch protection is NOT modified. The guard's own composed context (required-check-skip-guard / check-skip-vectors) runs on every PR advisory-only; its manifest row is mode: ADVISORY. Flipping it to REQUIRED on dev branch protection is a follow-up PR, gated on 2+ independent green runs on dev (which in turn is gated on OMN-14868 landing) — never in the same PR that introduces the workflow (self-wedge prevention).
• No pre-commit hook is added in this PR. omniclaude does not yet expose the validator as an installable pre-commit repo: hook (no .pre-commit-hooks.yaml manifest in omniclaude) or a pip-installable package containing .github/actions/required-check-skip-guard/*.py. Vendoring a local copy of the script into omnibase_compat would duplicate the canonical validator — the exact thing the CI side avoids via the reusable workflow's single-source-of-validator pattern (mirrors deploy-gate-reusable.yml@main). Wiring a local pre-commit hook is a tracked follow-up once omniclaude ships a consumable distribution mechanism.

Test plan

• Local validate_no_required_check_skip_vectors.py run against the new manifest + .github/workflows/ — PASS, 0 findings
• pre-commit run --files .github/workflows/required-check-skip-guard-caller.yml .github/required-checks.yaml — all applicable hooks pass
• gh pr checks — all 21 real REQUIRED contexts green; only the new non-required advisory guard check is red (documented above, OMN-14868)
• Follow-up ticket (post OMN-14868 fix, then 2+ green dev runs): flip required-check-skip-guard / check-skip-vectors to REQUIRED in omnibase_compat branch protection + manifest mode: REQUIRED
• Follow-up ticket OMN-14862: triage the schema-compat fork-safety if: finding

Closes OMN-14858

Evidence-Ticket: OMN-14858
Evidence-Source: OCC#4514

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 30 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: ef5ac4dc-acc9-48e6-bc9e-3818df115ee7

📥 Commits

Reviewing files that changed from the base of the PR and between 73db816 and b1c9304.

📒 Files selected for processing (2)

• .github/required-checks.yaml
• .github/workflows/required-check-skip-guard-caller.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jonah/omn-14858-required-check-skip-vector-guard-compat

---

_{Comment @coderabbitai help to get the list of available commands.}