move required status checks into Merge Queue ruleset

Author: rambleraptor

.asf.yaml

@@ -35,22 +35,6 @@ github:
     rebase: true
   protected_branches:
     main:
-      required_status_checks:
-        contexts:
-          # Repository policy and security checks.
-          - Analyze Actions
-          - Run zizmor 🌈
-          - asf-allowlist-check
-          - rat
-
-          # Documentation checks.
-          - docs
-          - markdown-link-check
-
-          # Python workflow gates.
-          - python-ci-required
-          - python-integration-required
-
       required_pull_request_reviews:
         required_approving_review_count: 1
 
@@ -65,6 +49,24 @@ github:
             - "~DEFAULT_BRANCH"
           exclude: []
       rules:
+        - type: required_status_checks
+          parameters:
+            # Merge Queue already tests each entry against the latest main
+            strict_required_status_checks_policy: false
+            required_status_checks:
+              # Repository policy and security checks.
+              - context: Analyze Actions
+              - context: Run zizmor 🌈
+              - context: asf-allowlist-check
+              - context: rat
+
+              # Documentation checks.
+              - context: docs
+              - context: markdown-link-check
+
+              # Python workflow gates.
+              - context: python-ci-required
+              - context: python-integration-required
         - type: merge_queue
           parameters:
             check_response_timeout_minutes: 90

AGENTS.md

@@ -68,7 +68,7 @@ lives under `pyiceberg/`, organized by concern rather than by engine:
 
 ### Required CI and Merge Queue
 
-- Keep the `required_status_checks.contexts` list in `.asf.yaml` synchronized whenever a required job/check is added, renamed, or removed. Each entry is a job/check context name, not a workflow filename.
+- Keep the `required_status_checks` list in the `Merge Queue` ruleset in `.asf.yaml` synchronized whenever a required job/check is added, renamed, or removed. Each entry is a job/check context name, not a workflow filename.
 - Verify that every required context reports for both `pull_request` and `merge_group`. Its producer workflow must run on both events.
 - When a workflow uses an aggregate required job, such as `python-ci-required`, keep `if: always()` and its `needs` list in sync with every job whose result should block merging.
 - Do not use `pull_request` path filters in workflows that produce required contexts. A skipped workflow does not report its required context, which blocks pull requests and causes Merge Queue entries to time out.