Why, and what was tried
The session raising this recommends: Both: require verdict + red backstop
#17513 merged today with a blocking review because nothing required one: main's only required check is Nested Gate, which checks the nested packages and never reads the review. Requiring the verdict closes the hole; the backstop catches a red that lands while a PR is already queued. Both are workflow or ruleset edits under the dangerous-diff rule, so they need your OK.
Tried first, unsuccessfully: Verified on GitHub: the 'Require CI' ruleset requires only Nested Gate. On head 8b045b5 Nested Gate passed 19:07:21Z (a real job, nested packages only), review started 19:09:26Z and failed 19:13:06Z, and the PR merged 19:21:36Z. Inside the queue, review passes automatically by design. Trinity found the gap and I confirmed it. This replaces b91416348, which had a typo (#17514) and the wrong root cause.
f598bd05 is parked on this.