refactor(doctrine): C2 coherence — 30 doctrine/skill tensions resolved, doctrine wins (BDR-099)

One ask policy; mandated executors exempt from the delegation rule; skill plan satisfies the planning rule; journal line exempt from the approval gate; chore = maintenance without new behaviour; small fix on develop = bugfix; BDR-068 written as the one auto-finish exception; deploy routes to /deploy. Skills and agents follow: hotfix types by base + skips the design gate on trivial; capitalize/close create missing registries; commit-change asks the branch type; doc/seo/web-validate/refactor branch through the aiguillage; tour reports BREAKING fixes as needs-decision and runs doc-syncer two-mode; client-handover applies audit bundles from its main loop behind one gate; init-project/onboard use the 200-file graphify signal and bootstrap memory; release-candidate gates the tag push only; push wording aligned with the BDR-095 hooks; stale pointers fixed (§ Language, .gsd/ROADMAP.md, handover script path, design-gate lists).

lib/verify-secure-loop.md

@@ -59,9 +59,9 @@ Parse its single `VERIFY — VERDICT:` line:
 
 - `CONFORME` → go to GATE 2. (First-pass conforme = no loop.)
 - `ECARTS(n)` → hand the dev the CONTRACT path + the exact `CRITERIA` gap
-  lines (NOT-MET / out-of-scope), nothing else. Inline dev fixes in place;
-  a dispatched dev is re-dispatched FRESH with those inputs only. Then
-  re-run GATE 0 and re-dispatch a FRESH verifier. Repeat.
+  lines (NOT-MET / out-of-scope), nothing else: re-dispatch a FRESH executor
+  with those inputs only, never redo the fix by hand. Then re-run GATE 0 and
+  re-dispatch a FRESH verifier. Repeat.
   **Max 3 conformity iterations** → STOP + human escalation with the
   CRITERIA table (the contract-vs-realized diff).
 - `ABANDONED(n)` → direct human gate, never a dev loop (a dev cannot close
@@ -88,8 +88,8 @@ stdout-only, no Write).
 Parse its single `SECURITY — VERDICT:` line:
 
 - `PASS` → done, proceed to commit.
-- `BLOCK(n)` → hand the dev the `BLOCKING` list + the CONTRACT path (inline
-  fix, or FRESH executor re-dispatch). Then re-run GATE 0, then
+- `BLOCK(n)` → hand the dev the `BLOCKING` list + the CONTRACT path
+  (re-dispatch a FRESH executor, never fix by hand). Then re-run GATE 0, then
   **re-verify the REQUEST first** (GATE 1, fresh verifier) — a security fix
   can drift the behavior — **then re-run GATE 2** (fresh auditor), in that
   order. **Max 3 security iterations** → STOP + human escalation with the