- pull_request trigger now runs on ANY base branch (was main/dev/gc-v2), so
  the tla-plus gate (and the CI behind it) runs on every PR.
- must-pass step now also runs VerifierKickoffFailOpenFixed (#429 fix design)
  and KickoffScanCoverageFixed (#431 shipped fix) - both must pass.
- bug-reproduction step now also tracks VerifierKickoffFailOpen (#429, LIVE),
  KickoffScanCoverage (#431, fixed by #451), and KickoffScanCoverageResidual
  (#431 depth-cap residual) as reproduction pointers; an unexpected PASS on any
  still fails the job as a drift signal.
- reproduction-step summary reworded: the list is no longer all-fixed-by-991faaa.

Verified locally: must-pass step exits 0 (11 specs), bug step exits 0 (all
reproduce, no drift).