docs: CHANGELOG + README for the gate entry point (no version bump)

README's Enforcement block now names controller_gates.py as THE entry point rather than
listing five of the seven gates individually. CHANGELOG records the allowlist entry, the
runner, the hook, the seam test and their red-proofs, and states the no-bump explicitly so
the omission reads as a decision.

controller/README.md

@@ -162,11 +162,17 @@ backups, monitoring and notifications. All Proxmox/disk operations are delegated
   logo-less app shows a placeholder on every list surface instead of a hidden icon; infra rows still
   override with the server glyph. The felhom brand mark is never an app placeholder (brand = platform
   identity only).
-  **Enforcement:** `scripts/template_id_gate.py` (JS element-ID integrity) + `scripts/emoji_gate.py`
-  (no emoji) + `scripts/native_confirm_gate.py` (zero native confirm/prompt) +
-  `scripts/app_row_dedup_gate.py` (row markup single-sourced) + `scripts/mojibake_gate.py`
-  (no double-encoded UTF-8 in templates/Go sources) — run after any template change; the Go
-  `TestNoEmojiInTemplates` mirrors the emoji gate.
+  **Enforcement — one entry point (2026-08-02):** run `python3 scripts/controller_gates.py` from
+  `controller/` after any template change. It is THE runner and invokes every gate:
+  `template_id_gate.py` (JS element-ID integrity), `emoji_gate.py` (no emoji),
+  `native_confirm_gate.py` (zero native confirm/prompt), `app_row_dedup_gate.py` (row markup
+  single-sourced), `mojibake_gate.py` (no double-encoded UTF-8 in templates/Go sources),
+  `docker_run_volume_path_gate.py` (every `docker … -v` mount reviewed), and `reuse_refs_check.py`
+  on the repo root. It exits non-zero if any gate does, and a missing gate script is a FAILURE, not
+  a skip. `--fast` (what `.githooks/pre-push` runs) selects the gates that touch no network and no
+  container runtime — today all of them. The Go `TestNoEmojiInTemplates` mirrors the emoji gate.
+  Why a runner: of this project's gates, only the ones named by a `CLAUDE.md` entry point ever got
+  run — the 2026-08-02 census found the two unnamed ones red, one for nineteen days.
 - **Europe/Budapest timezone** — All scheduled jobs, timestamps, and UI labels use Hungarian timezone.
 
 ### Module Map