docs(m175): reconcile Invariant 5 with the live protection set

Indy removed memleak and test-integration from main's required contexts — §6
deleted their workflows while both were still required, so #629 could not merge
until that landed. In the same change he promoted test-unit-rustd,
test-unit-app, test-unit-cli and test-unit-design-system to required.

That is stricter than this milestone planned. Invariant 5 said no new required
context lands here, on the PR #627 lesson that a required context which never
reports blocks the Pull Request. The lesson held from the opposite direction, and
the operator's call is recorded rather than left contradicting the repository:
the Rust job is required from now on.

The codecov FLAG stays non-required, which is a different surface — a job that
always reports cannot strand a Pull Request the way an absent context does.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>