fix(pm): dispatch-gates runs the diff-scoped issue-citation verdict locally, off the checker's own local-env declaration

The lint.yml step that runs `node scripts/check-issue-citations.mjs` passes
GITHUB_TOKEN and OS_GATE_MERGE_GROUP_BASE_SHA through `env:`, so the env
carrier classified the bare run NOT RUNNABLE LOCALLY and `--commands` offered
only its self-test. The checker now declares, in the existing dispatch-gates
marker idiom, that its bare invocation needs neither; dispatch-gates reads the
declaration (`declaredLocalEnv`, path-list grammar), grades it against the
workflows (`localEnvRefusal`: a name the step does not pass, or a bare run no
workflow makes, is refused) and spends it on the bare key alone
(`localEnvAdmitted`). The census and every other invocation keep their
classification.

Claude-Session: https://claude.ai/code/session_01MjvgiFAmjHqsxy1XLiVYfH
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

scripts/check-issue-citations.mjs

@@ -201,6 +201,8 @@ const PROXY_REARM_GUARD = 'OS_ISSUE_CITATIONS_PROXY_REARMED';
  */
 export const ROOT_DIR_WATCH_HINTS = ['content/docs/releases/**', 'packages/**'];
 
+// dispatch-gates: local-env GITHUB_TOKEN OS_GATE_MERGE_GROUP_BASE_SHA -- the BARE invocation, the diff-scoped verdict lint.yml runs on every pull request, answers that run's question on a dev container with neither value: GITHUB_TOKEN (or GH_TOKEN) is used when present and never required, because the diff mode reads the PUBLIC board with one probe per distinct number the change adds (it enumerates the whole board only past 400 of them) and re-arms the session proxy itself (rearmThroughProxy); OS_GATE_MERGE_GROUP_BASE_SHA renders EMPTY on a pull_request run, since only a merge_group build sets it, and with it unset baseSpellings takes merge-base(origin/main, HEAD), the base the pull_request run itself judges against. A board this run cannot read, or a base it cannot resolve, still exits PREREQUISITE NOT MET and never 0. Not declared for --census, which enumerates every page of the board and needs the token.
+
 /* ─────────────────────────── the scope contract ─────────────────────────── */
 
 /**