feat(gate): add canonical policy resolution

[screenleon]

Summary

• add a canonical gate-policy resolver backed by versioned signal and consumer registries
• enforce minimum tier, required reviewer coverage, pass kind, and content-bound user policy overrides
• preserve explicit user choice of sequential or parallel execution; infer the recommended mode only when callers omit it
• bind resolved policy coordinates into machine-owned assurance, gate verification, lifecycle reloads, and ship consumers
• harden detached gate readiness under concurrent scheduler load and clean one-shot ready/terminal sentinels
• record follow-up work for generated fallback provenance, reviewer-override symlink compatibility, and targeted CLI coordinate separation

Root cause and impact

The policy coordinates were previously resolved across multiple consumers, allowing tier, reviewer coverage, pass kind, and execution mode to drift. The new resolver owns those coordinates once and records the decision in verified assurance.

A separate full-suite failure exposed a detached-readiness race: after supervisor identity became temporarily unobservable, the launcher allowed only five 50 ms polls before reporting early death. Under concurrent load this produced false failures. The configured readiness timeout now owns the complete evidence window, while genuine timeout and early-exit paths remain fail-closed.

Validation

• tests/bin/run-all-tests.sh --jobs 4 --result-file /tmp/cc513-parallel-full-199d42f.json
  • 97 passed, 0 failed, 0 skipped, 0 timed out
  • authoritative: true
  • HEAD 199d42fbd7f78a45d9481a82da3ef657aeb0f9df
  • tree 6017f07cb1bf71e464598d0536a6d8758094db8df9a2b2411caa51f7c9312365
• tests/bin/run-tests.sh --verify-full /tmp/cc513-parallel-full-199d42f.json
  • authoritative full PASS for the current tree
• detached readiness stress, 24 launches at 8-way concurrency
  • before fix: 18/24 passed
  • after fix: 24/24 passed
• affected gate preflight: 7 suites passed, 0 failed
• Claude maintainer PR gate: Final GO
  • full tier, sequential mode, all five reviewer dimensions covered
  • critic approve; QA pass; architecture approve; security pass; risk pass
  • assurance verified
  • operation op-20260728T051940Z-be5f23
  • run gate-20260728-051940-8f99ab

Review note

The user explicitly selected sequential execution to control reviewer-session token cost. Policy recommended parallel for this large cross-boundary change, but explicit mode is a user-owned cost and independence choice; the assurance records that override, and reviewer coverage remained complete.

An earlier run, gate-20260728-051821-11466c, failed before reviewer dispatch because the injected preflight result sink conflicted with a --verify-full invocation. It consumed no reviewer session and is superseded by the verified GO run above.

Follow-ups

• CC-525: fix and ratchet the copy-mode verifier fallback generator provenance path
• CC-526: harden .gate-overrides.md / --override-file symlink handling under an explicit compatibility contract
• CC-527: separate targeted pass kind, reviewer coverage, and tier coordinates to remove ambiguous CLI labeling

Tracking: CC-513