chore(gate): commit pre-push gate (secret -> build -> test, fail-closed)

- scripts/gate/gate.sh: 3-stage gate — 1) gitleaks, 2) build
  (tsc on commit, full next build on push), 3) LLM parse contract
  tests. Fail-closed: setup errors, timeouts, and findings all block.
- scripts/gate/hooks/{pre-commit,pre-push}: exec gate.sh commit|push.
- scripts/install/install-hooks.sh: idempotent installer (verifies repo
  root, bootstraps pinned gitleaks 8.30.1 if absent, wires both hooks).
- scripts/install/bootstrap-gitleaks.sh: pinned per-user install,
  x86_64/arm64, GitHub release download + SHA-less checksum pin.
- .gitleaks.toml: useDefault=true; single allowlist = .env.example
  placeholder lines (secret= and change-me values) by path+regex.
  Real secrets — even inside .env.example — still trip the gate
  (empirically verified: OpenAI/AWS/Slack/GitHub tokens all caught).
- tests/llm-parse.test.ts: pins parse.ts contracts (strict 6-paragraph
  body, headline/scalar/or array rejection, stopword rules, tag
  fallback) — the choke point for LLM output parsing.
- package.json: 'test' script.
- README: 'Commit gate' section (install, stages, verified fail-closed
  modes).

Verified before commit: clean tree PASSes all 3 stages; staged
realistic secret FAILs stage 1 (exit 1); broken type FAILs stage 2;
broken assertion FAILs stage 3; next build exit 0.

scripts/install/install-hooks.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# Install the repo commit gate into this clone (idempotent, re-runnable):
+#   1. bootstrap gitleaks binary if missing  → ~/.local/bin/gitleaks (pinned)
+#   2. copy scripts/gate/hooks/*  → .git/hooks/*   (repo-local, NOT in repo)
+# 3-9 show what the gate will do on every commit/push.
+# Nothing here is in the committed history; hooks live in .git/hooks/.
+set -eu
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+[ -f "$ROOT/scripts/install/install-hooks.sh" ] || { echo "install: cannot find repo root from $(dirname "$0")" >&2; exit 1; }
+cd "$ROOT"
+
+echo "== 1/3 gitleaks"
+if ! command -v gitleaks >/dev/null 2>&1; then
+  if [ -x "$HOME/.local/bin/gitleaks" ]; then
+    echo "[install] gitleaks at ~/.local/bin (not on PATH) — will be used via absolute path"
+  else
+    bash scripts/install/bootstrap-gitleaks.sh
+  fi
+else
+  gitleaks version | sed 's/^/[install] gitleaks /'
+fi
+
+echo "== 2/3 hooks"
+install -m0755 scripts/gate/hooks/pre-commit .git/hooks/pre-commit
+install -m0755 scripts/gate/hooks/pre-push   .git/hooks/pre-push
+echo "[install] wrote .git/hooks/pre-commit, .git/hooks/pre-push"
+
+echo "== 3/3 ready"
+echo "[install] commits gated: secret → tsc → tests   (fast, seconds)"
+echo "[install] pushes  gated: secret(history) → full next build → tests"
+echo "[install] bypass (auditable at the pusher's shell): git commit/push --no-verify"
+echo "[install] NOTE: gate lives in THIS clone's .git/hooks — after git clone,"
+echo "[install] the same-branch pull on another machine re-installs by re-running:"
+echo "[install]   bash scripts/install/install-hooks.sh"