fix(gates): close the review findings in the gates and their docs

Two reproduced bugs in check-skill-version-bump:

- The origin/main-tip check fired even when the pushed skill was
  byte-identical to main's tip, so a cherry-pick or backport failed a
  push that ships nothing. The merge-base intersection ea119d8 added
  covers that only when some base carries the content, which a
  criss-cross history gives and a linear one does not. A new
  same_subtree compares tree object ids, so the exemption holds
  whatever route the history took.
- The failure line reported "baseline: none" when the skill was absent
  at every merge-base but present at the tip, and the Fix: line then
  named no version. The author writes the natural 1.0.0 and gets a
  second blocked push. It now falls back to the tip's version.

ADR-0022 is not amended: the documented behaviour does not change, and
ea119d8 set the precedent by fixing the same failure class script-only.

1614bce verified that executables.allow grants are version-blind and
corrected ADR-0019, gates.md and apm.yml, but missed the gate script's
own header and its operator-facing FAIL message, which still told the
reader deployment was silently broken, and gates.md's hook summary,
which still called it a silent-failure guard. All three now match.

Also: README's offline guarantee carries the populated-apm_modules
condition gates.md and AGENTS.md already state; the scripts/ layout row
drops "sync" for the three deleted sync scripts; the check-rtk-prefix
README rationale names the 12 subdirectory READMEs that survive rather
than the skill-root ones this branch deleted; gates.md re-cites its
three head -1 sites by enclosing function per its own :238 rule; and
deploy-manifest drops a pointer to a provider-manifest.sh that has
never existed on main.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NwD8Egs5r4ndqeFLmhusX2

.pre-commit-config.yaml

@@ -237,9 +237,11 @@ repos:
         entry: scripts/check-rtk-prefix.sh
         language: script
         files: '^plugins/[^/]+/\.apm/(skills/.*\.md|agents/.*\.agent\.md)$'
-        # README.md is excluded on purpose, not by oversight. A skill-directory
-        # README is consumer-facing prose that no agent ever loads, and the
-        # `git clone` lines in the six tests/README.md files are setup
+        # README.md is excluded on purpose, not by oversight. The 12 README.md
+        # files still in scope sit in a skill's scripts/, tests/ and assets/
+        # subdirectories -- consumer-facing prose that no agent ever loads (the
+        # skill-directory READMEs this was first written for are deleted) -- and
+        # the `git clone` lines in the six tests/README.md files are setup
         # instructions for a third party who has no rtk installed. Prefixing
         # those would be actively wrong -- see ADR-0023's consumer section.
         exclude: '(^|/)README\.md$'