S2 — Every push runs the checks

[The-Running-Dev]

Summary

.github/workflows/verify.yml already existed on main (added in an earlier
session) and genuinely satisfies S2.1–S2.3 as written. This PR closes the one
real gap: S2.4 requires "a workflow-parsing test asserts the step does not
swallow either [exit 1 or exit 2] with continue-on-error or || true" —
the Check the spec set step already meets that property, but no test
asserted it. Added one to tools/Test-CIWorkflow.Tests.ps1, following the
existing step-isolation pattern in that file.

While verifying, found and fixed the reason main's CI has been red since
afb4cf0: that commit updated 8 design/state/work/*.md WorkRef records but
never re-ran Update-DesignProjection.ps1, leaving design/state-index.md's
outstanding region stale against them. Regenerated it (9ba4f50) — a pure
projection refresh, no hand-authored content changed. That clears all 5
Pester failures and the blocking Test-DesignState.ps1 finding.

Criteria

• S2.1 met (pre-existing) — verify.yml runs on push/PR, installs only PowerShell 7 (via runs-on: ubuntu-latest + shell: pwsh) and Pester.
• S2.2 met (pre-existing) — five steps, each # verification: true-flagged, named exactly as specified.
• S2.3 met (pre-existing) — Run Pester tests carries GH_TOKEN; tools/Test-CIWorkflow.Tests.ps1 passes.
• S2.4 met (this PR) — added the missing workflow-parsing test; the step itself already had the right shape.
• S2.5 not met — Check the spec set still exits 2 (RegisterAbsent: no provisional-register region exists yet). This is not a defect: design/20-contract.md's error-semantics table names RegisterAbsent as an unchecked reason that forces exit 2 by design (SS5: "If any check is unchecked, the run exits 2 regardless of findings"). Authoring the register is S5's territory. main has been red for this same reason since S1 added the step — merging this PR does not regress anything, it removes the other, unrelated cause of red (the state-index staleness above).

A contract question this surfaced

design/30-slices.md § Contract questions → 1. The checker's steady state is exit 2, so CI is red forever already flags SS5's "any unchecked forces exit 2" semantics as likely wrong for the permanent CrossRepositoryUnresolvable case, and recommends SS5 escalate only on an unexpected unchecked entry. That question's own text says "S1–S3 and S5–S7 are unaffected" — that premise turned out to be wrong. RegisterAbsent is a second, narrower instance of the same SS5 mechanism, firing now, in S2, not S4. It's temporary (clears when S5 lands) rather than permanent, so the same fix doesn't obviously apply to it — but the recorded question's scope claim needs correcting. Flagging for /contract, not resolving it here (S2 isn't the right slice to touch SS5).

Verified

Ran and passed:

• Parse-check PowerShell scripts — every *.ps1 parsed with [System.Management.Automation.Language.Parser]::ParseFile, zero parse errors.
• Run Pester tests — Invoke-Pester -Path tools -Output Detailed -PassThru: 281 passed, 0 failed, 0 skipped.
• Validate the core/companion split — ./tools/Test-Companion.ps1: Companion split OK - 21 core(s) checked, 0 companion file(s) present, 21 core(s) with no companion. State: Valid. Exit code 0.
• Check the design state against the tree — ./tools/Test-DesignState.ps1: Findings (0), CouldNotEvaluate (0), ExitCode 0. Largest closure: unit/script/test-designstate, 6122 bytes (ceiling 16384).

Ran and failed: none.

Did not run:

• Check the spec set — ./tools/Test-SpecSet.ps1 returned State: NotEvaluated, Reason: RegisterAbsent. Exit code 2. Expected per SS5/contract, as explained above.

GitHub's verify check on b7853d9 (the pushed head) is confirmed Failed via Wait-PullRequestCheck.ps1, consistent with the local run — the job fails on the Check the spec set step's exit 2, the only step still non-passing.

Review threads: 0 found, confirmed on a re-query after a bounded wait for automated reviewers.