security-scan gate (shared felhom.eu/scripts/security_scan_gate.py) in the fast set and CI, warn-first, with the accepted-hits file and decoys (R-986)

scripts/agent_gates.py

@@ -15,6 +15,9 @@ Gates (all must pass; **non-zero exit on any failure**):
                      or because someone is offline on a train. CI runs the FULL set for exactly this
                      reason: it is the machine that can afford a network check, and it is the half
                      that emails when something is wrong.
+  …  security-scan   govulncheck (called vulnerabilities) + gitleaks on the pushed commits, WARN-FIRST: it lists,
+                     it never refuses (R-986). Shared: felhom.eu/scripts/security_scan_gate.py. In the fast set
+                     although it reads vuln.go.dev — offline it says NOT CHECKED, so it cannot stop a push.
   …  gate-decoys     the decoy suite (test_gate_decoys.py): every gate here still convicts its decoys
                      (R-1116). ~20 s in the workspace, so the full run only: not the hook, but CI
                      runs the full set on every push. Scratch clones and a local fake Gitea only.
@@ -49,6 +52,9 @@ SHARED_INSTRUCTIONS = os.path.join(
 # R-389 — shared, like the two above: it lives in felhom.eu/scripts/ and is never copied.
 SHARED_OBSERVATIONS = os.path.join(
     os.path.dirname(ROOT), "felhom.eu", "scripts", "observations_gate.py")
+# R-986 — shared too: the dependency and secret scanner, warn-first.
+SHARED_SECURITY = os.path.join(
+    os.path.dirname(ROOT), "felhom.eu", "scripts", "security_scan_gate.py")
 
 # (label, absolute script path, args, fast)
 GATES = [
@@ -70,6 +76,10 @@ GATES = [
     # R-1160 (2026-10-19) — every Go file is gofmt-clean; the controller's gofmt_gate.py shape. Fast: one gofmt -l.
     # Where the runner has no Go it says NOT CHECKED out loud and passes; the pre-push hook (with Go) enforces it.
     ("gofmt", os.path.join(ROOT, "scripts", "gofmt_gate.py"), [], True),
+    # R-986 (2026-10-19) — govulncheck + gitleaks, WARN-FIRST (exit 0 whatever it finds). Fast although it reads
+    # vuln.go.dev: it cannot refuse, so a network blink is a NOT CHECKED line. ~4 s here. CI: gitleaks fetched pinned
+    # (FELHOM_SCAN_FETCH=1), no Go, so govulncheck says NOT CHECKED there.
+    ("security-scan", SHARED_SECURITY, [ROOT], True),
 ]
 
 VERDICT = {0: "OK", 1: "FAILED", 2: "INCONCLUSIVE"}