R-404: the golden NOTICE, in the repo where the debt is created - NOT A RELEASE

No version heading on purpose. No Go code, no image, no version bump; giving this one would create
the exact golden debt the change is about.

Until today this repo - where a release actually happens - had NO golden-currency check at all,
while felhom.eu ran one on every push including documents-only ones that can neither create the
debt nor clear it. The person who could act heard nothing; the person who could not act was
blocked, thirteen --no-verify uses' worth.

golden_notice.py is ADVISORY IN EVERY CASE, and that is the only correct behaviour rather than
timidity: at the moment a release is committed the golden legitimately does not exist yet, so
blocking there would refuse the commit that STARTS the process - and blocking later is the mistake
being undone.

NO SECOND IMPLEMENTATION: it IMPORTS felhom.eu/scripts/golden_currency_gate.py and calls that
gate's own released_versions()/newest_baked(), so it is the same comparison read in the other
direction. Cross-repo shape copied from instructions_gate.py; never a copy of the script, because a
copy recreates the drift these gates exist to detect. An absent sibling clone is INCONCLUSIVE and
silent about currency - it never guesses.

controller_gates.py GAINED A FIFTH `blocking` FIELD. It could not express a reporting-only gate at
all before: every registered gate's non-zero exit failed the run, so the only way to add a notice
was to give it the power to refuse a push. The capability was added rather than the notice
compromised (R-420). False for exactly one gate, and test_golden_notice.py asserts it stays one.

Tests N1-N4 with a positive control that every other gate is still blocking. RED-PROOF RUN: making
the debt branch return 1 fails N1 - in production that would refuse the commit that starts a
release.

CHANGELOG.md

@@ -1,3 +1,29 @@
+## scripts — the golden NOTICE, where the debt is created (2026-09-01, R-404) — NOT A RELEASE
+
+**No version heading on purpose.** This changes no Go code, builds no image and bumps nothing. Giving
+it a version would create the exact golden debt the change is about.
+
+`controller/scripts/golden_notice.py`, registered in `controller_gates.py` as the first
+**non-blocking** gate. Until now this repo — where a release actually happens — had no
+golden-currency check at all, while `felhom.eu` ran one on every push including documents-only ones
+that can neither create the debt nor clear it. So the person who could act heard nothing and the
+person who could not act was blocked, thirteen `--no-verify` uses' worth (R-404, R-417).
+
+- **It is ADVISORY IN EVERY CASE and that is the only correct behaviour**, not timidity: at the
+  moment a release is committed the golden legitimately does not exist yet, so blocking there would
+  refuse the commit that starts the process — and blocking later is the mistake being undone.
+- **No second implementation.** It IMPORTS `felhom.eu/scripts/golden_currency_gate.py` and calls that
+  gate's own `released_versions()` / `newest_baked()`, so it is the same comparison read in the other
+  direction. Cross-repo shape copied from `instructions_gate.py`; the script is never duplicated here.
+- **Absent sibling clone → INCONCLUSIVE and silent about currency.** It never guesses.
+- **`controller_gates.py` gained a fifth `blocking` field** — it could not express a reporting-only
+  gate before, so the capability was added rather than the notice compromised (R-420). False for
+  exactly one gate; a test asserts that.
+
+Tests: `controller/scripts/test_golden_notice.py` (N1–N4, with a positive control that every other
+gate is still blocking). **Red-proof run:** making the debt branch return 1 fails N1 — in production
+that would refuse the commit that starts a release.
+
 ## v0.232.0 — one writer at a time, and a check that can actually run (2026-09-01, R-411/R-408/R-407, R-414, R-412a)
 **MinAgent: 0.129.0** (unchanged)