X_PRIVATE_NAMES_UNSET
Means
the private-name secret is missing where the names are required
Typical cause
ULTIMATE_PRIVATE_NAMES_REQUIRED=1 with ULTIMATE_PRIVATE_NAMES empty. ci.yml sets the flag beside the secret only on the gate part that runs boundaries on a push to main, so its absence there is a misconfiguration, and a guard that skipped would pass forever while scanning nothing. Every other run, a unit job or a fork's pull request included, skips
Fix
gh secret set ULTIMATE_PRIVATE_NAMES (an admin, pasting the off-tree list, one name per line, at its prompt), then re-run the workflow