fix(ci-queue-watch): fail without a fleet token instead of reporting a green it did not earn

[github-actions]

The token check warned and exited 0, and the observe step was gated on
steps.tok.outputs.ok == 'true'. So on any scheduled run with FLEET_READ_PAT
unset — which is every run today — the watchdog reported SUCCESS having observed
nothing at all.

The comment defending that said an environmental condition must not look like a
fleet outage. Half right, wrong conclusion. A watchdog that goes green without
looking is not cautious, it is absent, and it is worse than having none: the
green gets read as "the fleet queue is fine". This is the same vacuous-gate shape
as gate-authz ending in || true and the gitleaks config that loaded zero
rules — a check whose success carries no information.

It now fails, and the concern the old comment had is preserved where it actually
belongs: in the message. The error names the missing secret, says explicitly that
this is a missing secret in THIS repository and not a fleet outage, and gives the
exact scope to grant (classic PAT repo, or fine-grained Actions=read on the
Fuze* repos). A red that says "this check could not run" is honest; a green that
means nothing is not.

Verified: zero steps remain gated on the removed tok output, so there is no
path left where the observe step is silently skipped.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01GaPa3JgrVNtWrGvqQEAEqv

[izzywdev]

All CI gates pass (gate-authz, gate-ds-conformance, gate-identifier, gate-frames-first, gate-test, gate-lint, gate-build, gate-sast, gate-toolchain, gate-version, gate-localup, etc.). Approving per governance policy.

[izzywdev]

Closing as superseded by #797 — owner decision.

This PR and #797 are the same design: make the token step exit 1 with a configuration-specific error, and delete the if: steps.tok.outputs.ok == 'true' gate so the observe step cannot be silently bypassed. Both are correct.

#797 was chosen because it carries the same change plus three mutation-verified tests in scripts/__tests__/test_ci_queue_watch.py, asserted against the real workflow file rather than a fixture — each mutation (reverting the guard, restoring the if: gate, dropping the outage disclaimer) is shown to fail the assertion written for it. Given that this whole PR is about a check that reported green without looking, shipping it with tests that are proven to fail on the bug is the stronger version.

A third PR, #780, took an incompatible approach and is closed alongside this one.

No work is lost — the defect is fixed by #797, in this form.

---

Generated by Claude Code