Merge pull request 'fix(ci): type-check gates the protected merge status (closes #148)' (#167) from fix/type-gate-dependency into master

.gitea/workflows/ci.yml

@@ -195,7 +195,9 @@ jobs:
   required-checks:
     if: gitea.event_name == 'pull_request'
     runs-on: self-hosted
-    needs: [lint, unit-tests, canary, best-practices, documentation, gitea-offline]
+    # #148: type-check MUST gate the protected status — a red type-check job
+    # previously left the protected merge gate green (dependency-chain hole).
+    needs: [lint, unit-tests, canary, best-practices, documentation, type-check, gitea-offline]
     steps:
       - name: Publish protected-branch gate
         run: echo "All required CI checks passed"