#2598 gatorwalk-factory: gates and limits (GW-5)

Part of the gatorwalk-factory rebuild of @swamp/software-factory. GW-1..GW-4 shipped (#2576, #2584, #2588; PRs 327-329). GW-5 is next on the self-hosting path (then GW-6 work-item type, GW-8 driving skill).

GW-4's advance takes an injected gate evaluator; GW-5 supplies the real one and the two circuit breakers, as pure code in gatorwalk-factory/extensions/models/_lib over the GW-4 run record and CEL context.

Scope:

• Port the gate evaluators for the GW-2 gate library: artifact-exists, artifact-fresh (reviews subject version, recordedThisCycle), findings-clear, human-approval (minApprovals), evidence-recorded (current stage and cycle, requireField), cooldown, max-cycles, cel. workflow-succeeded is not in the launch library.
• human-approval reads GW-4's approval records: the latest decision per actor in the current stage, cycle and era, and only while the products it was bound to are unchanged (an approval given before the plan changed does not approve the new plan; #1501).
• Cycle limit: entries into a stage past maxCycles park the work item until a person grants an override. Every grant counts (#1487, #2175): grants accumulate, they do not reset the counter.
• Dispatch cap: a dispatch past maxDispatchesPerCycle is refused as a suspected runaway loop, with a human override (today nobody can grant one; #916, #899).
• Overrides are their own records, not approval ids with a reserved prefix, so no id is ever interpolated into a path or shell word (#2290).
• Every gate failure explains itself: which gate, what it needed, what it found.

Out of scope: the model type (GW-6), graph analysis (GW-9). Nothing is published.