feat(inventory): require ubi9-base-micro python gate

[NWarila]

Summary

• Add the already-reporting python / required reducer to ubi9-base-micro's required status checks.
• Update the required-checks ADR from eleven to twelve contexts and document the reducer's path-selection behavior.

Applying this inventory makes python / required a required status check that blocks merges for any actor not exercising a bypass. It transitively gates the selected upstream Python evidence jobs; it does not force those jobs to run when change detection selects no Python-related path. The Pull Request Gate's always-on Repository Admin bypass remains intentional, so this does not make the Python chain unbypassable. The framework sets integration_id = null, so the context is not app-bound.

Reporting and availability

GitHub reports the exact check-run name python / required on the current ubi9-base-micro main commit. A required name that never reports would leave merges blocked indefinitely. The active Build base python workflow triggers on pull_request targeting main with no workflow-level paths filter, and its python-required reducer uses if: ${{ always() }}.

The reducer therefore reports for every admitted, normally scheduled pull-request run targeting main. This adds a fail-closed availability dependency: a first-time external contributor's run can await maintainer approval under the first_time_contributors Actions policy, while an outage, cancellation, or a pull request that breaks or deletes the workflow can prevent the report. Those cases block rather than silently pass and are recoverable by rerunning or using the admin bypass. If a merge queue is added later, this workflow must also gain a merge_group trigger so merge-queue commits receive the context.

Apply behavior

A push to main passes apply=false and cannot apply managed GitHub changes, but it is NOT isolated plan_only — the caller does not pass plan_only, so the run uses the real S3 backend and may perform state adoption imports. The ruleset change takes effect only on a later terraform-deploy dispatch with apply=true, and that dispatch reconciles the whole assembled inventory — so the operator must review the preceding push plan for unrelated drift before dispatching.

Validation

• GitHub check-runs API: exact context python / required reports successfully.
• Current workflow: unfiltered pull_request trigger for main; reducer condition if: ${{ always() }}.
• Local YAML lint, Markdown lint, actionlint, and git diff --check pass.