catalog-since gate: an image: move must bump the app's catalog_since (R-452) — hook-enforced, shallow CI skips out loud

scripts/catalog_gates.py

@@ -15,6 +15,7 @@ Gates, in order (all must pass; **non-zero exit on any failure**):
   1. image-pins          static, instant, whole repo — no :latest / untagged / floating alias
   2. image-resolvable    network — every pinned tag still EXISTS upstream
   3. volume-persistence  RUNTIME — the folder a template preserves is the folder the app writes to
+  5. catalog-since       static, needs GIT HISTORY — an image: move bumps that app's catalog_since (R-452)
   4. engine-major        static, needs GIT HISTORY — no database engine pin crosses a MAJOR version
                          (operator ruling 2026-09-13; expires when Slice 4 / R-448 ships). Runs in the
                          pre-push hook, which has the full clone; on a SHALLOW clone (CI fetches at
@@ -75,6 +76,9 @@ GATES = [
     ("image-resolvable",   "check-image-resolvable.py",   True,  False, False),
     ("volume-persistence", "check-volume-persistence.py", True,  False, False),
     ("engine-major",       "check-engine-major.py",       False, True,  True),
+    # R-452 (2026-09-13): an image: move must bump that app's catalog_since. Same shape as
+    # engine-major — git history, fast, skipped out loud on a shallow clone.
+    ("catalog-since",      "check-catalog-since.py",      False, True,  True),
 ]
 
 VERDICT = {0: "OK", 1: "FAILED", 2: "INCONCLUSIVE"}