feat(gate): add immutable subject verification

[screenleon]

Summary

• introduce gate_assurance_v3 with a stable Git subject, base/head bindings, tree fingerprint, dirty policy, timestamps, and digest-linked evidence
• add a shared pmctl gate verify assessment with independent artifact_valid, subject_current, and policy_applicable axes plus reason codes and JSON output
• route gate wait and ship finish through the shared assessment so stale or policy-insufficient Final: GO text cannot authorize continuation
• preserve historical inspection compatibility while requiring all three axes for named consumers
• add schema, copy/replay, linked-worktree, repository mismatch, base/head/tree drift, fixed-ref, digest, and policy-insufficiency coverage

Why

Gate consumers previously could verify structural integrity but could not reliably distinguish a forged artifact from an intact artifact whose reviewed subject had become stale, or from an artifact that remained current but did not satisfy the consuming policy. Gate wait and ship finish also retained separate continuation checks, creating a risk of policy and freshness drift.

This change gives all consumers one fail-closed assessment contract and treats the physical worktree path as provenance rather than repository identity.

Impact

• current v3 artifacts can authorize named consumers only when validity, freshness, and applicability all pass
• moved HEAD, advanced base, dirty-tree drift, repository mismatch, and malformed linked evidence produce explicit axis-specific reason codes
• copied artifacts remain inspectable but cannot claim canonical dispatch authorization
• v1/v2 artifacts remain readable for historical inspection but cannot prove immutable-subject freshness or consumer applicability

CC-515 is complete as the shared verifier foundation. Its evidence-link contract supports unavailable|verified scope-manifest and closure links and verifies a linked artifact's basename, digest, and subject fingerprint. The actual gate_scope_manifest_v1 content/producer remains CC-518; the remediation_closure_v1 lifecycle/producer remains CC-517. Those are downstream tickets that depend on CC-515, not unfinished CC-515 scope.

Verification

Runtime implementation subject c97bab0e1faef385c9eb6fb38b0cd032c3057346:

• refactor/reuse audit: complete; no additional shared abstraction or simplification was warranted
• implementation full PR gate: Final: GO, full tier, sequential mode, maintainer policy; critic, QA, architecture, security, and risk all passed
• test-only remediation gate: Final: GO; targeted QA passed; maintainer verification reported artifact_valid, subject_current, and policy_applicable all pass
• authoritative full suite: 97 passed, 0 failed, 0 skipped
• canonical full-result verification: PASS for tree fd0e5d996b82d1d69f97d401268feaa89f017c83639792df9e0ba55df784b5f8
• full result: .pm-dispatch/test-results/latest-full.json

Docs-only tracking correction 6b05527:

• mark CC-515 closed and record PR feat(gate): add immutable subject verification #454
• clarify that CC-518/CC-517 own downstream scope/closure producers
• update CC-511 Phase B dependency wording now that the CC-515 verifier dependency is satisfied
• pm/scripts/validate.sh BACKLOG.md DECISIONS.md CHANGELOG.md: PASS
• bash tests/shell/test-pmctl-backlog.sh: 18 passed, 0 failed
• git diff --check: PASS
• PR-gate intentionally not rerun for this metadata-only correction, per explicit user direction

Current PR HEAD: 6b05527.

Tracking: CC-515