fix(runner): run branch-filtered jobs on merge-queue refs, and say why a job skipped

Changes

diff --git a/src/runner.rs b/src/runner.rs
index 37cc03c..6daaf08 100644
--- a/src/runner.rs
+++ b/src/runner.rs
@@ -466,7 +466,11 @@ impl Runner {
                     .iter()
                     .filter(|candidate| job.needs.contains(&candidate.base_name))
                     .collect::<Vec<_>>();
-                if dependencies.iter().any(|dependency| {
+                // Name the dependency and its real status. The bare
+                // "dependency did not succeed" read as a test failure when the
+                // dependency had merely been filtered out by `branches:`, which
+                // sent a reader hunting for a break that did not exist.
+                if let Some(blocker) = dependencies.iter().find(|dependency| {
                     matches!(
                         dependency.status.as_str(),
                         "failed" | "skipped" | "canceled" | "interrupted"
@@ -475,7 +479,10 @@ impl Runner {
                     self.database.set_job_status(
                         job.id,
                         "skipped",
-                        Some("dependency did not succeed"),
+                        Some(&format!(
+                            "dependency {:?} is {}",
+                            blocker.base_name, blocker.status
+                        )),
                         None,
                     )?;
                     progressed = true;
@@ -535,15 +542,6 @@ impl Runner {
             .git_ref
             .strip_prefix("refs/heads/")
             .unwrap_or(&run.git_ref);
-        if !spec.branches.is_empty() && !spec.branches.iter().any(|allowed| allowed == branch) {
-            self.database.set_job_status(
-                job_id,
-                "skipped",
-                Some("Git ref is not allowed for this job"),
-                None,
-            )?;
-            return Ok(());
-        }
         let repository_trusted = self.database.repository_trusted(run.repository_id)?;
         let repository_default_branch = self.database.repository(&run.repository)?.default_branch;
         // A trusted *repository* only earns unrestricted execution on its
@@ -565,6 +563,36 @@ impl Runner {
                     .ok()
             })
             .is_some_and(|detail| detail.pull_request.target_ref == repository_default_branch);
+        // `branches:` filters are matched against the branch this ref is going
+        // to BECOME, not its literal name. A merge-queue staging ref is the
+        // default branch's own pre-merge commit, so a job gated on `[main]`
+        // must run there -- otherwise the queue's CI is strictly WEAKER than
+        // the branch's, which inverts the gate: verify/package/deploy-production
+        // all skipped on refs/merge-queue/N and the merge landed code that was
+        // never packaged, never deployed, and never saw fmt/clippy/full tests.
+        // This mirrors the native-executor trust exception directly above.
+        let effective_branch = if queue_targets_default {
+            repository_default_branch.as_str()
+        } else {
+            branch
+        };
+        if !spec.branches.is_empty()
+            && !spec
+                .branches
+                .iter()
+                .any(|allowed| allowed == effective_branch)
+        {
+            self.database.set_job_status(
+                job_id,
+                "skipped",
+                Some(&format!(
+                    "job is limited to branches {:?} and this run is on {effective_branch:?}",
+                    spec.branches
+                )),
+                None,
+            )?;
+            return Ok(());
+        }
         let ref_trusted =
             repository_trusted && (branch == repository_default_branch || queue_targets_default);
         if spec.executor == "native" && (!self.allow_native || !ref_trusted) {
@@ -2016,6 +2044,72 @@ mod tests {
         }
     }
 
+    #[test]
+    fn branch_filter_matches_merge_queue_refs_targeting_the_default_branch() -> Result<()> {
+        // A `branches: [main]` job MUST run on refs/merge-queue/N when that
+        // entry's PR targets main. Before this, verify/package/deploy-production
+        // all skipped on the queue ref, so the queue's CI was strictly weaker
+        // than the branch's and a queue merge landed code that was never
+        // packaged, never deployed, and never saw fmt/clippy/full tests.
+        let root = tempfile::tempdir()?;
+        let database = Database::memory(KEY)?;
+        let repo = database.add_repository("app", "https://example.com/app.git", "main")?;
+        database.create_pull_request(
+            "app",
+            "Feature",
+            "",
+            "feature",
+            "main",
+            &"a".repeat(40),
+            &"b".repeat(40),
+            "alice",
+            "Alice",
+        )?;
+        database.add_pull_request_review("app", 1, "bob", "Bob", "approved", "ship it")?;
+        let entry = database.enqueue_merge("app", 1, "tester")?;
+        let run_id = database.create_run(
+            repo.id,
+            &format!("refs/merge-queue/{}", entry.id),
+            None,
+            "webhook",
+        )?;
+        let mut spec = make_job_spec("build", "native", None);
+        spec.branches = vec!["main".into()];
+        database.insert_jobs(run_id, &[spec])?;
+        let runner = Runner::new(database, root.path().to_owned(), true)?;
+        let workspace = root.path().join("workspaces").join(run_id.to_string());
+        fs::create_dir_all(&workspace)?;
+        let job = runner.database.jobs(run_id)?[0].id;
+        runner.execute_job(run_id, job, &workspace, &RunCancellation::new())?;
+        let job = &runner.database.jobs(run_id)?[0];
+        assert_eq!(job.status, "succeeded", "{:?}", job.logs);
+        Ok(())
+    }
+
+    #[test]
+    fn branch_filter_still_skips_an_unrelated_ref_and_says_why() -> Result<()> {
+        let root = tempfile::tempdir()?;
+        let database = Database::memory(KEY)?;
+        let repo = database.add_repository("app", "https://example.com/app.git", "main")?;
+        let run_id = database.create_run(repo.id, "refs/heads/feature", None, "manual")?;
+        let mut spec = make_job_spec("build", "native", None);
+        spec.branches = vec!["main".into()];
+        database.insert_jobs(run_id, &[spec])?;
+        let runner = Runner::new(database, root.path().to_owned(), true)?;
+        let workspace = root.path().join("workspaces").join(run_id.to_string());
+        fs::create_dir_all(&workspace)?;
+        let job = runner.database.jobs(run_id)?[0].id;
+        runner.execute_job(run_id, job, &workspace, &RunCancellation::new())?;
+        let job = &runner.database.jobs(run_id)?[0];
+        assert_eq!(job.status, "skipped");
+        assert!(
+            job.logs.contains("limited to branches") && job.logs.contains("feature"),
+            "skip reason must name the filter and the actual ref: {:?}",
+            job.logs
+        );
+        Ok(())
+    }
+
     #[test]
     fn native_job_rejected_on_non_default_branch_of_trusted_repository() -> Result<()> {
         let root = tempfile::tempdir()?;