padosoft-ci-workflow-gateslisted

# CI workflow gates **A gate that cannot fail is not a gate**, and the ways one stops being able to fail are rarely visible in the diff that broke it. Most of what follows is a green check that had not looked at anything. --- ## 1. The gate has to be able to see the whole contract A manifest that lists what must exist, but **omits itself and its own workflow**, stays green after half the contract is deleted. Enumerate every mandatory rule, workflow, validator and file — including the ones doing the checking. Related shapes of the same failure: - **Presence-only matching accepts an empty contract.** Checking that a `Tests:` marker exists says nothing about whether anything follows it. Require non-empty content, and accept both inline prose and a following block, because documents legitimately use both. - **A detector as strict as the parser cannot see malformed input.** If the strict parser only accepts `M01-S02`, a candidate detector built on the same pattern is blind to `M01-SO2` and `M01-S100` — exactly the typos it exists to catch. **The candidate detector must be broader than the parser**, then report what it found that the parser rejected. - **Validating the items does not validate the set.** Unique ids and well-formed entries still allow one entry to silently disappear. If the count is part of the contract, version the manifest and assert it. ## 2. A security gate fails closed, or it is decoration ```text ❌ files larger than N are skipped → a cr