fix(gates): hold skill versions above main's tip as well as the merge-base

Why: two branches that both bump a skill 1.0.0 -> 1.0.1 with different
content merge without a conflict, and each passed the gate against its own
merge-base, so main could ship two changes under one version.

Implementation Notes:
- check-skill-version-bump requires the pushed version to exceed both the
  merge-base and the main tip; failures name the baseline they missed.
- Presence is read from the tree, so a blob missing from a partial clone is
  a read failure instead of a silently exempt "new" skill.
- A leading UTF-8 BOM no longer reads as a missing version.
- Version parts reject leading zeros in all three validators
  (check-skill-version-bump, skill-size-check, factory-audit).
- New tests cover equal bumps, moved files, major/minor ordering, bad refs,
  unreadable blobs, mode-only changes, symlinks and tag peeling.

Impact: ADR-0022 amended (reverses "not main's current tip"); gates.md
updated to match, including pre-commit 4.6.1's exact ref selection.

ADR: 0022
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/skill-size-check.sh

@@ -1374,7 +1374,10 @@ for path in files:
     if version_val is None:
         error("%s: metadata.version field is missing (required frontmatter "
               "field, e.g. \"1.0.0\")." % path)
-    elif not re.match(r'^\d+\.\d+\.\d+$', str(version_val).strip().strip('\'"')):
+    # Same shape as check-skill-version-bump.sh: ASCII digits, at most nine per
+    # part (bash arithmetic), no leading zero (semver 2.0.0 item 2).
+    elif not re.fullmatch(r'(0|[1-9][0-9]{0,8})\.(0|[1-9][0-9]{0,8})\.(0|[1-9][0-9]{0,8})',
+                          str(version_val).strip().strip('\'"')):
         error("%s: metadata.version is malformed (%r) -- expected a "
               "three-part semver, e.g. \"1.0.0\"." % (path, version_val))