Requirements;

1. The 'merge when ready' button is not clickable until all presubmit checks pass.
2. Team members can land a change to fix the tree when the tree is red without admin privileges.
3. Reverts created with the 'revert' label continue to behave as they do today.

One way to accomplish (1) is by adding a 'merge queue guard' check that is blocking the same way that the ci.yaml check is blocking.

The 'merge queue guard' check remains in a pending state until all other presubmit checks finish, including the 'tree-status' presubmit check. If a presubmit check fails, the 'merge queue guard' turns red, and the 'merge when ready' button remains unclickable. If all presubmit checks pass, the 'merge queue guard' turns green and the 'merge when ready' button becomes clickable.

Then (2) can be accomplished as follows. The presence of the 'break glass' label tells the 'merge queue guard' check to ignore the 'tree-status' check. That is, all other presubmits have to be green, but the intention is to land the PR on a red tree.

For (3), the revert bot behaves such that the 'merge queue guard' check allows valid reverts created by adding the 'revert' label to a PR to land more-or-less immediately, as they do today.