docs: CHANGELOG + REPORT for the CI workflow

CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## CI — the static catalog gate runs on every push (2026-08-02, R-168)
+
+**No version bump, no build, no deploy** — this adds a workflow file only. Stated explicitly so the
+omission reads as a decision rather than a miss.
+
+**`.gitea/workflows/gates.yml` (new).** Triggers on `push`, `runs-on: felhom-gates`, obtains the
+source with a shallow `git fetch` of the **exact pushed SHA** from the in-cluster Gitea Service, and
+runs this repo's entry point with `--fast` — nothing else. **No `uses:` step anywhere**: JavaScript
+actions need a node runtime the host-mode runner does not have, and probe P3 measured a plain
+`git fetch` as sufficient. No `|| true`; the entry point's exit code IS the job's result.
+
+**It REPORTS, it cannot REFUSE**, and the workflow header says so: this repo pushes straight to
+`main` with no pull request, so there is no merge for a status check to stand at. The refusing half
+is `.githooks/pre-push`, which is per-clone and `--no-verify`-able; this half notices when that was
+skipped. Making CI blocking needs branch protection plus a PR workflow → felhom.eu `OPEN-ITEMS.md`
+R-169, an operator decision.
+
+**A failed run emails the operator** via Resend and prints the provider's accepted id, because probe
+P5 measured that Gitea itself sends nothing at all on a failed run. Demonstrated end to end on a real
+red run (`RESEND-ACCEPTED id=…`), not assumed. Full detail:
+`felhom.eu/documentation/audits/SPIKE-ci-runner-2026-08-02.md`.
+
+**`--fast` only, and that is the point.** `check-image-pins.py` runs; `check-image-resolvable.py`
+(network) and `check-volume-persistence.py` (Docker, minutes per app) do **not**. CI that pulls 53
+images on every push gets disabled, and the bypass becomes the habit. Measured in the first run:
+`image-pin gate OK — 53 templates, 0 unpinned images`, with both runtime gates announced as skipped
+and their own output absent from the log. They remain deliberate periodic runs.
+
+No sibling clone is needed here — unlike the controller and the agent, `catalog_gates --fast` does
+not invoke the shared reuse checker.
+
 ## 2026-08-02 — `--fast` for the pre-push hook (no version: this repo carries none)
 
 **`scripts/catalog_gates.py --fast`** selects only gates that touch no network and no container