P1: Implement the Open Gate Gaps That Pass the Three-Condition Hook Test

[ptr727]

Part of #1311. Priority: next. One pull request per gate, each with a test that watches it fail.

Why

The fleet's rigor lives in its gates, and 14 open issues describe a rule that exists only in prose while its failure is decidable from bytes. GOVERNANCE.md "Durable Knowledge" already states the three-condition test for promoting a rule to a hook, and #1083 asks for the general design call. These are the ones that pass it today, and they are being starved while sessions spend their budget on prose rounds. This is "gates in code", and it is where the review effort should go.

Scope

Work through these, each on its own branch, in this order:

1. Agents moved a repo's version floor four times under a retired cadence rule; prose alone did not hold #1124 and A Retired Version-Cadence Rule Is Still Asserted in Downstream Carried Text, and Agents Act on It #1146: a version floor edit by an agent fails the gate unless the commit carries the maintainer's marker. Decidable from the diff.
2. gh-write-guard requirement 4 does not cover an inline hooks-path override #1127 and GH_WRITE_GUARD_ALLOW_PRIMARY_CHECKOUT is a session-wide, path-blind grant, so a standalone-clone fallback also unlocks the maintainer's base checkout #1130: the write guard denies an inline -c core.hooksPath override the way it denies --no-verify, and resolves the primary-checkout target before honoring the allow variable.
3. Closing references: a feature PR's Fixes line is inert, and a negated keyword still fires #1265 and A Squash Merge Drops a Pull Request Body's Closing Keywords, So Promotion Closes Nothing #1297: after a promotion opens, compare closingIssuesReferences against the feature pull requests' Closes on promotion lines, and fail the promotion body assembly on a mismatch. Reading the body does not work and the issue explains why.
4. The AGENTS.md Preamble Is Not a Canonical Review Unit, So Its Edits Reach No Gate #1193: canonical_review.py derives a preamble unit for AGENTS.md so the most widely carried edit reaches a gate.
5. The skill's after-edit check does not reach a composite action it now tells an agent to edit #1249: the after-edit check the skill names reaches composite actions, not only .github/workflows.
6. spec/audit.py: _code_view drops a folded-scalar body, so requireTokensInJob cannot see a token in the if: >- shape GOVERNANCE mandates #1133 and Audit Cannot See an IsTestProject-Only C# Test Project, and validate-task.yml Keeps a Header Summary Block #1259: spec/audit.py reads folded-scalar bodies and IsTestProject declarations, so a repo following the mandated shape is not reported as violating it.
7. validate-task.yml: three gaps blocking the last carried-copy repo from adopting it (no ref input, root-relative Python detection, no coverage assertion) #1134, Audit check: an MTP-based dotnet test project with no global.json runner opt-in #1108, Intent-tier checks have no mechanical floor, so a codecov.yml that gates PRs passes the audit #1110, spec/audit.py Mis-Measures the Shapes the Fleet Mandates, and Intent Tier Has No Floor #1142: the validator takes a ref input, detects Python below the root, asserts coverage output, and intent-tier entries get the partial mechanical floor Intent-tier checks have no mechanical floor, so a codecov.yml that gates PRs passes the audit #1110 describes for the shapes that can be checked.

Rules that bind this task

• A gate ships with the test that reintroduces the fault and confirms the gate objects. A gate nobody has watched fail is a gate nobody knows works.
• A gate fails loud. A pattern that matches nothing is an error, never a pass.
• Platform-specific gates are verified on the platform they run on, or shipped labeled unverified.
• Each item is its own pull request. Do not bundle.

Acceptance

• Each listed issue closes with a merged gate and a test.
• #1083's design question is answered by this batch plus the three-condition rule, and closes or is re-scoped to what remains.

Closes #1124, #1127, #1130, #1193, #1249, #1133, #1259, #1134, #1108, #1110, #1265, #1297. Relates #1083, #1142, #1146.