The decoy suite is a gate of the full run (R-1116); no code change

controller/scripts/test_gate_decoys.py is now controller_gates.py's `gate-decoys` row: blocking, full run only
(~22 s, 53 cases, and it edits real files in the tree for a moment, so never the hook). Declared in its own
COVERS; test_controller_gates.py pins it. Red-proved: debug-routes/comment flipped to expect accept ->
CONVICTED: gate-decoys; restored, green. gates.md's "--fast is all of them" corrected.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

.claude/rules/gates.md

@@ -14,7 +14,9 @@ one, `golden-notice`, is ADVISORY and never refuses. **The `GATES` table is the
 pointer to it, not a second copy** — it drifted twice (it said "seven" while nine were registered, then
 named ten local gates while fourteen were).
 
-- `--fast` selects the gates that touch no network and no container runtime; today that is all of them.
+- `--fast` selects the gates that touch no network and no container runtime; today that is all of them
+  except `gate-decoys` (the decoy suite, ~22 s, edits real files in this tree for a moment; R-1116), which
+  runs in the full run only — so the hook and CI do not run it.
 - **A missing gate script is a FAILURE, never a skip.**
 - **The shared `reuse_refs_check.py`, `instructions_gate.py` and `observations_gate.py` live in `felhom.eu/scripts/` and are
   never copied here** — a copy would recreate the drift they detect; an absent sibling clone FAILS.