Audit: Renovate PR #276 (.github digest bump) stuck 'blocked' since 2026-09-21 #346

What fails
#276 (FerrLabs/.github digest to be40b72) has been open with mergeable_state: blocked since 2026-09-21, even though every check is success or skipped.

Evidence
FerrVault is on three different digests: 39502a0 in ci.yml:16, security-scan.yml:19 and pr-title.yml:13; 9796e97 in mcp-ci.yml:27 and release.yml:23; 7c84741 in dco.yml:12. Benchmarks and Fixtures are already on be40b72. On the PR's head, one 'PR title / Conventional commits' run was cancelled and one skipped.

Impact
FerrVault misses every reusable fix since 2026-09-21: the SNYK_TOKEN declaration (#398), the checksum and injection hardening (#403, #404), Trivy severity gating (#378) and tag signing (#366). Each new .github change widens the gap, and Renovate keeps rebasing this PR without merging it.

Expected
Find what blocks the merge in branch protection: a required check name that no longer exists, a required review, or the cancelled PR-title run. Then merge #276. Branch protection could not be read from the audit run.