Follow-up: Exercise GitHub Actions changes from PR #4475

[justin808]

Source PR: #4475

Changed workflow/action files:

• .github/workflows/ci-commands.yml
• .github/workflows/ci-required.yml

Post-merge exercise required:

1. After PR Tighten final gate CI evidence #4475 merges, post +ci-run-hosted or +ci-force-full on a closed or merged PR where the original branch is no longer a live open PR head.
2. Confirm the ci-commands.yml issue_comment workflow refuses the command before dispatch, reacts confused, and posts the degraded-evidence explanation for non-open PRs.
3. Use the next real open PR, or a cleanup-only verification PR, to post +ci-run-hosted and confirm the open-PR dispatch path still works.
4. Confirm the ci-required.yml required gate runs ruby script/pr_merge_ledger_test.rb on the post-merge workflow version.

Expected evidence:

• Link to the closed/merged PR command comment.
• Link to the ci-commands.yml workflow run handling the command.
• The posted refusal includes the PR state, merged status, and the statement that branch-ref hosted-CI evidence is degraded/invalid after merge/close.
• No hosted-CI dispatch run or hosted-CI labels are added from the closed/merged PR command.
• Link to the open-PR command comment and workflow run showing normal hosted-CI dispatch still works.
• Link to the required-gate workflow run showing the merge-ledger fixture test step executed.

Cleanup:

• If a verification-only PR is created, close it after evidence is collected and delete its branch.
• Remove any verification-only hosted-CI labels/comments only if they would confuse later release evidence.

Owner: unknown.

[justin808]

Closing per maintainer approval of the 2026-07-11 triage close list (#4607). The changed paths are exercised on every PR (ci-required merge-ledger fixture step) and main is green; the +ci-* refusal paths fail safe and get exercised naturally on the next maintainer CI command. No dedicated verification run needed.