fix: the merge gate could not block a merge

[stxkxs]

merge-gate had the right shape and a condition that made it inert.

Skipped reports Success

It ran if: github.event_name == 'pull_request' rather than if: always(). A job whose dependency fails is skipped, and GitHub counts a skipped check as passing for branch protection — from the docs, "A job that is skipped will report its status as 'Success'. It will not prevent a pull request from merging, even if it is a required check."

So the gate reported success in exactly the case it exists to catch. It has been harmless only because this repo has no branch protection and nothing requires the check. Requiring it — which is the point of having it — would have installed a gate that cannot block.

Two more, found while fixing that

Its needs: named nine of the eleven other jobs. build was covered only transitively, through the four jobs that depend on it. docs was not covered at all — it could fail with the gate still green.

Its body was fifteen echo "✅ …" lines. Six of them — approval-gate invariant, Slack adapter discipline, HTTP-client discipline, secret inventory agreement, chart secret paths, vendored byte-identity — correspond to nothing in the dependency list. The job asserted properties it had no way to observe, verified nothing directly, and printed a checklist that read as though it had.

Now

Depends on all eleven jobs, runs if: always(), and delegates to the shared gate in nanohype/.github (nanohype/.github#26), which:

• treats anything other than success as failure — skipped and cancelled included
• refuses an empty needs:
• reads this workflow file back and fails if any job in it is unwatched

That last check is what would have caught the missing docs dependency without anyone noticing it by hand.

Verified locally: the gate now names 11 of 11 jobs, nothing unwatched, if: always().