fix(ci-queue-watch): fail without a fleet token instead of reporting a green it did not earn

.github/workflows/ci-queue-watch.yml

@@ -70,20 +70,30 @@ jobs:
       # job -- say so loudly and exit 0. Never red a scheduled run on a missing
       # secret: an environmental condition must not look like a fleet outage,
       # which is the same inversion the actor gate caused in a2a-maintain.
-      - name: Check for a fleet-scoped token
-        id: tok
+      # THIS STEP USED TO WARN AND EXIT 0, with the observe step below gated on its
+      # output. The stated reasoning was that an environmental condition must not
+      # look like a fleet outage. That is half right, and the conclusion was wrong:
+      # with no token the scheduled run reported SUCCESS having observed nothing.
+      # A watchdog that goes green without looking is not a cautious watchdog, it
+      # is an absent one — and it is worse than none, because the green is read as
+      # "the fleet queue is fine".
+      #
+      # It now FAILS. The distinction the old comment cared about is preserved
+      # where it belongs — in the message, which names the missing secret and the
+      # exact scope to grant, so the red is self-describing and cannot be mistaken
+      # for a fleet outage. A red saying "this check could not run" is honest; a
+      # green that means nothing is not.
+      - name: Require a fleet-scoped token
         env:
           FLEET_READ_PAT: ${{ secrets.FLEET_READ_PAT }}
         run: |
           if [ -z "$FLEET_READ_PAT" ]; then
-            echo "::warning::FLEET_READ_PAT is not set — the watchdog can only see this repo, so it is skipping. Set a PAT with read access to Actions across the fleet (scope: repo, or fine-grained Actions:read on the Fuze* repos)."
-            echo "ok=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "ok=true" >> "$GITHUB_OUTPUT"
+            echo "::error title=ci-queue-watch::FLEET_READ_PAT is not set, so this watchdog CANNOT observe the fleet queue. This is a MISSING SECRET in this repository, not a fleet outage. Set FLEET_READ_PAT to a token with read access to Actions across the fleet (classic PAT: scope 'repo'; fine-grained: Actions=read on the Fuze* repos). Until then this fails rather than reporting a green it did not earn."
+            exit 1
           fi
+          echo "fleet-scoped token present"
 
       - name: Observe the fleet CI queue
-        if: steps.tok.outputs.ok == 'true'
         env:
           GITHUB_TOKEN: ${{ secrets.FLEET_READ_PAT }}
           STALL: ${{ inputs.stall_minutes || '30' }}