fix(gates): close the review findings in the gates and their docs

Two reproduced bugs in check-skill-version-bump:

- The origin/main-tip check fired even when the pushed skill was
  byte-identical to main's tip, so a cherry-pick or backport failed a
  push that ships nothing. The merge-base intersection ea119d8 added
  covers that only when some base carries the content, which a
  criss-cross history gives and a linear one does not. A new
  same_subtree compares tree object ids, so the exemption holds
  whatever route the history took.
- The failure line reported "baseline: none" when the skill was absent
  at every merge-base but present at the tip, and the Fix: line then
  named no version. The author writes the natural 1.0.0 and gets a
  second blocked push. It now falls back to the tip's version.

ADR-0022 is not amended: the documented behaviour does not change, and
ea119d8 set the precedent by fixing the same failure class script-only.

1614bce verified that executables.allow grants are version-blind and
corrected ADR-0019, gates.md and apm.yml, but missed the gate script's
own header and its operator-facing FAIL message, which still told the
reader deployment was silently broken, and gates.md's hook summary,
which still called it a silent-failure guard. All three now match.

Also: README's offline guarantee carries the populated-apm_modules
condition gates.md and AGENTS.md already state; the scripts/ layout row
drops "sync" for the three deleted sync scripts; the check-rtk-prefix
README rationale names the 12 subdirectory READMEs that survive rather
than the skill-root ones this branch deleted; gates.md re-cites its
three head -1 sites by enclosing function per its own :238 rule; and
deploy-manifest drops a pointer to a provider-manifest.sh that has
never existed on main.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NwD8Egs5r4ndqeFLmhusX2

scripts/check-executables-allow-sync.sh

@@ -2,11 +2,15 @@
 set -euo pipefail
 
 # Fails the push when root apm.yml's executables.allow key stops naming
-# kyberforge's actual version. apm matches that key by exact dict lookup
-# (apm_cli/security/executables.py) — a version bump that misses the key
-# update deploys nothing, with no error anywhere. See ADR-0019, "The allow
-# key is version-pinned, and that is a live failure mode", for the full
-# argument; nothing else in the pre-push gate compares these two files.
+# kyberforge's actual version. The grant itself is version-blind — apm matches
+# the version-less name alongside '<package>#<version>' (exec_gate.py builds
+# the candidate list, _map_grants matches it) — so a stale key keeps granting
+# kyberforge's hooks/ and bin/ and deployment does not break. What this gate
+# buys is repo-level, not apm-level: a version bump without the matching key
+# edit fails this repo's own pre-push, so the key stays an accurate record of
+# what was approved. See ADR-0019's 2026-09-19 correction and docs/spec/gates.md,
+# "check-executables-allow-sync"; nothing else in the pre-push gate compares
+# these two files.
 #
 # Run from repo root or pass REPO_ROOT as arg.
 
@@ -213,10 +217,10 @@ if [[ -n "$STALE_KEYS" ]]; then
   echo "  Found instead:" >&2
   printf '%s\n' "$STALE_KEYS" | sed 's/^/    /' >&2
 fi
-echo "  Why: apm matches this key by exact dict lookup — there is no wildcard and no version-less" >&2
-echo "       form — so a key naming any other version silently stops granting kyberforge's hooks/" >&2
-echo "       and bin/. The SessionStart hook then stops deploying and the apm install goes stale" >&2
-echo "       with no error anywhere (ADR-0019, 'The allow key is version-pinned')." >&2
+echo "  Why: nothing is broken right now — apm's grant is version-blind, so a key naming another" >&2
+echo "       version still grants kyberforge's hooks/ and bin/. This gate is a repo-level record" >&2
+echo "       check: a version bump without the matching key edit fails here, which is what keeps" >&2
+echo "       the key an accurate record of what was approved (ADR-0019, 2026-09-19 correction)." >&2
 echo "  Fix: bump the key in root apm.yml to '$EXPECTED_KEY:' — the version bump in" >&2
 echo "       plugins/kyberforge/apm.yml is not complete without it." >&2
 exit 1