--fast only: check-image-pins runs; the network and container-runtime gates do NOT. CI that
pulls 53 images on every push gets disabled, and they remain deliberate periodic runs.
No sibling clone needed here — unlike the controller and the agent, catalog_gates --fast
does not invoke the shared reuse checker. No uses: step, no version bump.
