chore(gate): commit pre-push gate (secret -> build -> test, fail-closed)

- scripts/gate/gate.sh: 3-stage gate — 1) gitleaks, 2) build
  (tsc on commit, full next build on push), 3) LLM parse contract
  tests. Fail-closed: setup errors, timeouts, and findings all block.
- scripts/gate/hooks/{pre-commit,pre-push}: exec gate.sh commit|push.
- scripts/install/install-hooks.sh: idempotent installer (verifies repo
  root, bootstraps pinned gitleaks 8.30.1 if absent, wires both hooks).
- scripts/install/bootstrap-gitleaks.sh: pinned per-user install,
  x86_64/arm64, GitHub release download + SHA-less checksum pin.
- .gitleaks.toml: useDefault=true; single allowlist = .env.example
  placeholder lines (secret= and change-me values) by path+regex.
  Real secrets — even inside .env.example — still trip the gate
  (empirically verified: OpenAI/AWS/Slack/GitHub tokens all caught).
- tests/llm-parse.test.ts: pins parse.ts contracts (strict 6-paragraph
  body, headline/scalar/or array rejection, stopword rules, tag
  fallback) — the choke point for LLM output parsing.
- package.json: 'test' script.
- README: 'Commit gate' section (install, stages, verified fail-closed
  modes).

Verified before commit: clean tree PASSes all 3 stages; staged
realistic secret FAILs stage 1 (exit 1); broken type FAILs stage 2;
broken assertion FAILs stage 3; next build exit 0.

README.md

@@ -66,6 +66,35 @@ npx prisma migrate diff --from-empty --to-schema-datamodel prisma/schema.prisma
 npm run seed                     # manual ingest + synthesis pass
 ```
 
+## Commit gate (secret → build → test, fail-closed)
+
+Every commit and push runs a three-stage gate (`scripts/gate/gate.sh`), in this fixed order:
+
+| Stage | pre-commit (fast) | pre-push (heavy) |
+|---|---|---|
+| 1 — secret | `gitleaks protect --staged` | `gitleaks protect` over full HEAD history |
+| 2 — build | `tsc --noEmit` (strict) | `prisma generate && next build` (pristine production build) |
+| 3 — test | `tests/llm-parse.test.ts` (LLM parse contract, 21 pins) | same |
+
+- **Fail-closed:** a missing tool, a crash, a timeout, or any finding blocks the
+  operation. Only a deliberate `git commit --no-verify` / `git push --no-verify`
+  bypasses it (auditable in the terminal scrollback).
+- **Secret stage:** full gitleaks default ruleset, hard-blocks. The one allow
+  exception is a file- and content-scoped suppress of *empty/placeholder*
+  values in `.env.example` (see `[allowlist]` in `.gitleaks.toml`) — a real key
+  written into that file still fires.
+- **Test stage:** `tests/llm-parse.test.ts` pins the synthesis parse contract
+  (6-paragraph cap, 160-char headline, ≤5 takeaways, sanitized tags,
+  JSON-fence recovery, determinism). It imports only `src/lib/llm/parse.ts` —
+  pure, zero-dep, zero-network — so it runs under `tsx` with no framework.
+- **Install (idempotent, per clone):**
+  ```bash
+  bash scripts/install/install-hooks.sh
+  # → bootstraps gitleaks (pinned 8.30.1) into ~/.local/bin if missing,
+  #   copies scripts/gate/hooks/* into .git/hooks/
+  ```
+- Walk away from a fresh machine: `npm ci && bash scripts/install/install-hooks.sh`.
+
 ## Configuration
 
 All configuration is in `.env` (local, gitignored — only `.env.example` is committed):