security-scan gate (shared felhom.eu/scripts/security_scan_gate.py) in the fast set and CI, warn-first, with the accepted-hits file and decoys (R-986)

CHANGELOG.md

@@ -1,3 +1,12 @@
+## Unreleased (2026-10-19) — the security-scan gate (R-986); no code change
+
+- `controller_gates.py` registers `security-scan` (FAST set, so the pre-push hook and CI run it): the SHARED
+  `felhom.eu/scripts/security_scan_gate.py` — govulncheck (called vulnerabilities) on `controller/` and gitleaks on the
+  pushed commits, **warn-first** (it lists, it never refuses). `.security-accepted` at the repo root holds the first
+  scan's 4 accepted hits (test constants and decoy values), each with a reason. CI fetches the pinned gitleaks
+  (`FELHOM_SCAN_FETCH=1` in `gates.yml`). Decoys: the shared 8 run from `test_gate_decoys.py`, plus the gate on this
+  repo. First scan: 0 called vulnerabilities, 0 real secrets (felhom.eu `audits/night-2026-10-19/P7/triage.md`).
+
 ## v0.335.0 — no app stop for an off-site tier the agent will refuse because its host is busy (R-921) (2026-10-19)
 
 **MinAgent: 0.158.1** — the floor's, carried. The new check needs the agent's `host_busy` answer (felhom-agent,