docs: CHANGELOG + README for the gate entry point (no version bump)

README's Enforcement block now names controller_gates.py as THE entry point rather than
listing five of the seven gates individually. CHANGELOG records the allowlist entry, the
runner, the hook, the seam test and their red-proofs, and states the no-bump explicitly so
the omission reads as a decision.

CHANGELOG.md

@@ -1,5 +1,44 @@
 ## Changelog
 
+### Gate enforcement — one entry point + pre-push hook (2026-08-02) — NO VERSION BUMP
+
+**Deliberately no version bump, and no build or deploy.** Nothing compiled changed: this touches
+`controller/scripts/` and `.githooks/` only, so no behaviour on any box moves. Stated explicitly so
+the omission reads as a decision rather than a miss.
+
+**`controller/scripts/docker_run_volume_path_gate.py` — one allowlist entry, in its own commit
+(`c432f70`).** The gate was RED, flagging `internal/appexport/estimate.go:179`. The finding is
+benign: `realVolumeSize` mounts a **named Docker volume** read-only into a throwaway alpine to `du`
+it from a container view — no host path is involved, the daemon resolves the volume name daemon-side,
+and it is structurally identical to the already-allowlisted `internal/backup/backup.go` entry. The
+gate was right to demand review; that diff **is** the review, on its own, because burying an
+allowlist widening inside a feature commit is how an allowlist stops meaning anything.
+`realVolumeSize` was not touched — the code is correct; the allowlist was incomplete.
+
+**`controller/scripts/controller_gates.py` (new) — THE entry point.** A census of all thirteen gate
+scripts across the four felhom repos found that every check a `CLAUDE.md` names was passing and two
+of the four nobody is told to run were failing. This repo had seven gates and `CLAUDE.md` named
+two; four more were reachable only through a line in `REUSE.md`, and the docker-`-v` gate through one
+line in `REUSE.md` and nothing else — while RED. The runner invokes all seven plus `reuse_refs_check`
+on the repo root, streams each gate's own output, and exits worst-wins non-zero. `--fast` selects the
+gates that touch no network and no container runtime; today that is all eight.
+
+**The shared checker is never copied here.** `reuse_refs_check.py` lives in `felhom.eu/scripts/` and
+is invoked across the workspace at `<repo-root>/../felhom.eu/scripts/`. A copy would recreate exactly
+the drift it exists to detect. If the sibling clone is absent the gate **FAILS** and prints the path
+tried — fail-closed. On this repo it now resolves 133 cited paths: 126 exact, 6 by suffix, and
+`wgsync/reconciler.go` cross-repo into the hub.
+
+**`.githooks/pre-push` (new)** — runs `controller_gates.py --fast` and refuses the push. Per-clone
+(`git config core.hooksPath .githooks`; a manual run WARNS when the clone is unarmed) and
+`--no-verify`-able on purpose; both limits are written into the hook. CI is the unbypassable half and
+is owed — `felhom.eu` `OPEN-ITEMS.md` R-168.
+
+**`controller/scripts/test_controller_gates.py` (new, 4 tests)** — a SEAM test asserting each member
+gate's own distinctive stdout, never the runner's summary line, which an inert runner prints while
+calling nothing. Red-proofed: replacing `run_gate`'s body with `return 0` still prints "all controller
+gates OK" and exits 0, and turns the seam test red.
+
 ### v0.188.0 — D5: an app restore works from the drive alone (2026-07-30) — MinAgent 0.113.0 (unchanged)
 
 **Tier-1/Tier-2 no longer depend on the whole-guest tier.** Until now the recovery unit on the