feat(gates): deterministic floor (GATE 0) under the fresh verifier

GATE 1 is an LLM dispatch and the verifier's mandatory PROOF: line is a line
the verifier writes — nothing structurally stops it being produced without
anything being executed. Nothing deterministic sat between the executor and
that dispatch.

An acceptance criterion can now carry an oracle: indented CHECK: (command),
EXPECT: (success-only marker), EVIDENCE: (slot). lib/gates.sh runs them
fail-closed — MET requires exit 0 AND the marker, so a nonzero process never
passes on its error text carrying the token — and writes the outcome back
into the contract, so the fresh verifier reads evidence as fact rather than
trusting the executor's report.

GATE 0 runs that floor before any verifier is dispatched; a red build sends
the executor back for free, on its own iteration budget. ABANDON: <id>
<reason> turns an impossible criterion into a visible handoff that blocks
CONFORME and routes to the human gate, via the new ABANDONED(n) verdict —
a distinct token because it routes distinctly, never a dev loop. feater and
bugfixer gain a four-pass completion discipline, scoped so a pass can never
widen the contract.

The runner's parse fails closed on partial oracles, duplicate ids,
unindented attributes and runnable criteria with no EVIDENCE: line, and
executes nothing at all when the ledger is malformed. status never executes
and never writes; run always re-executes, since trusting written evidence is
the failure being closed.

Adapted from the unlazy skill (Leonxlnx/unlazy, MIT). Its Stop hook,
approval store, .unlazy/ tree, depth-tree arithmetic and Node checker were
deliberately refused — BDR-083 records each reason.

64 assertions in lib/tests/gates.test.sh, non-execution proved by sentinel
with its own positive control asserted first.

agents/feater.md

@@ -57,6 +57,25 @@ report below is optional on this path (the dispatcher needs the edit applied
   editing `.claude/**` or memory registries, user questions (you cannot
   ask — report instead), attribution trailers of any kind.
 
+## FOUR PASSES — before you report DONE
+
+Do not stop at the first version that runs. Loop these until a full pass
+finds nothing:
+
+1. **Complete.** The whole deliverable the plan names is implemented. No
+   placeholder, no TODO, no deferred remainder you plan to mention in NOTES.
+2. **Expert reread.** Read it as someone who owns this codebase. Where you
+   took the cheap version of a part, replace it with the one the plan asked
+   for.
+3. **Defect hunt.** Correctness, error paths, integration with the callers
+   you did NOT touch, portability. Fix what you find.
+4. **Polish.** Low-cost only: naming, comment density, dead code you
+   introduced.
+
+Every pass stays inside the plan and the contract FILE SCOPE. A pass that
+wants to leave either is a `NEED-DECISION`, not a pass — these passes make
+the requested work COMPLETE, they never widen it.
+
 ## OUTPUT — end with exactly this report (your final message)
 
 ```