feat: configurable merge gate (branch protection + directory isolation) and skill body/appendix checks

- cloud/merge_gate.py: pure gate; directory check reuses the v0.3
  git diff --name-only merge-base command; protection modes
  record (default, explicit confirm required when unprotected),
  enforce (always blocks when unprotected), off (explicit only).
  Confirm covers protection risk only, never directory violations.
  Protection status is caller/env-declared only; unknown is a
  recorded risk, not a claim of protection.
- server POST /tasks/{id}/merge: applies the gate only when gate
  evidence is supplied (or env declares protection); no-evidence
  calls behave as before plus a merge_gate field in the response.
  Blocked merges return 409 without changing status; confirmed
  unprotected merges write a merge_gate_risk audit entry.
- skill_seed.py: whole-directory seeding evaluated and rejected
  (cannot preserve tenant deletions; no benefit while the pack
  holds only SKILL.md); SKILL.md-only behaviour unchanged.
- software-engineering SKILL.md: gate paragraph added to the body
  and to the coordinator + client appendix sections (v0.2 text on
  this base; port to v0.3 text on rebase after #199 merges).
- tests: 16 new tests covering gate modes, directory reuse,
  body/appendix bidirectional assertions naming the missing side,
  SKILL.md-only seeding and tenant-edit preservation.

cloud/skill_seed.py

@@ -40,6 +40,21 @@ passes, do not claim the skills are live in production tasks --
 this helper only guarantees the files land in the tenant home,
 idempotently, without clobbering tenant edits, and that
 skills/list sees them there.
+
+Whole-directory seeding evaluation (2026-10-30, conclusion: NOT DONE):
+copying a whole skill directory instead of only SKILL.md was evaluated
+and rejected, so the behaviour above is unchanged. A per-file
+skip-if-differ rule would preserve a tenant-modified file's content,
+but it cannot preserve a tenant's *deletion* (a missing destination
+file is recopied, resurrecting a file the tenant removed on purpose)
+and it would auto-seed every future pack file into tenant homes
+without review -- new surface, no benefit today, since every pack
+directory currently contains only SKILL.md. The hard line stands:
+a tenant-modified file is never overwritten, and whole-directory
+copying is not adopted unless a future evaluation proves both
+content-preservation AND deletion-preservation. Until then, only
+SKILL.md is seeded; extra files in a pack directory are ignored
+(pinned by test_merge_gate_protectskill.py).
 """
 
 import shutil