feat(ci): criticality tiers — Gate/Check/Advisory/Auto (pilot)

Make each CI check telegraph its own criticality. ci/CI-CRITICALITY.toml is the
source of truth (🔴 Gate=must/pass-or-die = branch-protection required set;
🟡 Check=should; ⚪ Advisory=could-skip; ⚙ Auto=not a gate), and every workflow
name: now leads with the matching glyph + a clearer indicative name (e.g.
'Dogfood Gate' -> '🟡 Check: RSR self-use (dogfooding)'; 'OSSF Scorecard' ->
'⚪ Advisory: OpenSSF Scorecard (score)'). Safe here (no branch protection yet);
the [gate] list is the recommended required-checks set. Pilot — promote to
standards + rsr-template once proven. Note: rhodibot still references a
'Hypatia Neurosymbolic Analysis' workflow absent from these repos (lives in
standards) — left untouched.

Author: hyperpolymath

.github/workflows/boj-build.yml

@@ -5,7 +5,7 @@
 # It is a no-op if BOJ_SERVER_URL is not set or the server is unreachable.
 # To enable: set BOJ_SERVER_URL as a repository secret or variable.
 # To disable: delete this file or leave BOJ_SERVER_URL unset.
-name: BoJ Server Build Trigger
+name: "⚙ Auto: BoJ server build trigger"
 on:
   push:
     branches: [main, master]

.github/workflows/codeql.yml

@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
-name: CodeQL Security Analysis
+name: "🟡 Check: CodeQL security analysis"
 on:
   push:
     branches: [main, master]

.github/workflows/dependabot-automerge.yml

@@ -34,7 +34,7 @@
 # Dependabot config via the github-actions ecosystem block, so SHA
 # bumps for dependabot/fetch-metadata flow through the same path.
 
-name: Dependabot Auto-Merge
+name: "⚙ Auto: Dependabot auto-merge"
 on:
   pull_request:
     types: [opened, reopened, synchronize]

.github/workflows/dogfood-gate.yml

@@ -4,7 +4,7 @@
 # dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate
 # Validates that the repo uses hyperpolymath's own formats and tools.
 # Companion to static-analysis-gate.yml (security) — this is for format compliance.
-name: Dogfood Gate
+name: "🟡 Check: RSR self-use (dogfooding)"
 
 on:
   pull_request:

.github/workflows/e2e.yml

@@ -12,7 +12,7 @@
 # INSTRUCTIONS: Uncomment and customise the section matching your stack.
 # Delete sections that don't apply. See examples in each job.
 
-name: E2E + Aspect + Bench
+name: "🟡 Check: E2E + aspect + bench"
 on:
   push:
     branches: [main, master, develop]

.github/workflows/estate-rules.yml

@@ -9,7 +9,7 @@
 # Each rule is enforced by an executable check script under scripts/. Failures
 # are surfaced as workflow errors so the rule can't silently regress.
 
-name: Estate Rules
+name: "🟡 Check: Estate rules"
 on:
   push:
     branches: [main]

.github/workflows/governance.yml

@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-name: Governance
+name: "🟡 Check: Governance metadata"
 
 on:
   push:

.github/workflows/guix-nix-policy.yml

@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
-name: Guix/Nix Package Policy
+name: "🔴 Gate: Guix-only package policy"
 on:
   push:
     branches: [main, master]

.github/workflows/hypatia-scan.yml

@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-name: Hypatia Security Scan
+name: "🟡 Check: Hypatia baseline security scan"
 
 on:
   push:

.github/workflows/instant-sync.yml

@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # Instant Forge Sync - Triggers propagation to all forges on push/release
-name: Instant Sync
+name: "⚙ Auto: Instant sync"
 on:
   push:
     branches: [main, master]