marketing/facebook: R-919 report filled in (gates rc=0, CI #849 green, reproducibility proven)

DooPlex gates at the pushed commit 796a9fdf: rc=0, all 18 OK. A plain rebuild
there left git status --porcelain -- marketing/ empty, so the committed PNGs are
exactly what the committed script produces on the build machine; both controls
fired in that run.

CI gates.yml #849 for 796a9fdf40 is green. Recorded how it was read, because
both obvious ways are wrong here: the Gitea API still 401s on every credential
in the store, and the run's own page redirects to the internal id and renders
through JavaScript, so its HTML carries "success", "failure", "running" and
"cancelled" as template strings whatever the outcome. The conclusion comes from
the list page, from the same flex-item row that holds the commit link -- and
splitting that list on class="flex-item" chops the row, because the child divs
share the prefix, which would attribute the icon to a neighbouring run.

REPORT-facebook-cover-r919.md

@@ -8,7 +8,7 @@ builds on: `documentation/audits/facebook-page-setup-2026-10-08/`.
 | | |
 |---|---|
 | Baseline | `felhom.eu` `main` = `a76207945e`, clean on the Windows tree and on DooPlex |
-| Pushed | see §9 |
+| Pushed | `796a9fdf` to `main` (no branch, explicit paths, no `Co-Authored-By` line) |
 | Repos touched | `felhom.eu` only — `marketing/facebook/`, `marketing/CHANGELOG.md`, `documentation/backlog/OPEN-ITEMS.md`, this report |
 | Built on | **DooPlex** (Pillow 11.1.0), not the workstation — see §4 |
 
@@ -138,7 +138,44 @@ is the operator's two steps and what to do if the app still cuts the cover.
 
 ## 9. Gates, commit, CI
 
-Filled in below after the run.
+**Gates.** `python3 scripts/repo_gates.py --fast` **on DooPlex, at the pushed commit `796a9fdf`**: **rc = 0**,
+„all felhom.eu gates OK”, all 18 gates `OK` — including `register-shape`, `one-register`, `closed-register`
+and `observations`, which are the ones this change could have broken. It was run twice: once on the working
+tree before committing, once after DooPlex pulled the pushed commit.
+
+The gates were **not** run on the Windows workstation this session. The two failures they produce there
+(`instructions`, from the deliberate `E:\git\CLAUDE.md` divergence, and `script-tests`, from `fcntl`, symlink
+privilege and `C:`/`E:` mount paths) are platform artifacts documented in `REPORT-facebook-page-setup.md` §9;
+nothing in this change touches either.
+
+**Build reproducibility, proven at the pushed commit.** After DooPlex pulled `796a9fdf`, a plain
+`python3 marketing/facebook/build.py` exited 0 and left `git status --porcelain -- marketing/` **empty** —
+the committed PNGs are exactly what the committed script produces on the build machine. Both controls fired
+in that run: the circle check convicted today's profile shape, and `control_old_window` convicted the
+pre-R-919 layout.
+
+**Commit.** `796a9fdf40c469670269b7ae16833156a9f6dd0e`, pushed to `main`. No branch, explicit paths staged,
+no `Co-Authored-By` line, `--no-verify` not used (this clone is unarmed, which is why the DooPlex run above
+was done by hand).
+
+**CI — green, for this commit.** `gates.yml` run **#849**, commit **796a9fdf40**, status
+`tw-text-green octicon-check-circle-fill`.
+
+Two notes on how that was read, because the obvious ways are both wrong here:
+
+- **The Gitea API still refuses every credential in the store** (HTTP 401; tried last session with
+  `DOCKER_USERNAME`+`DOCKER_PASSWORD`, `DOCKER_USERNAME`+`PASSWORD`, `admin`+`PASSWORD`), so the `head_sha`
+  recipe in `CLAUDE.md` cannot be run. The web UI serves this repo's Actions list unauthenticated, so it was
+  read from there with `curl`.
+- **The run's own page is useless to `curl`**: `/actions/runs/849` redirects to the internal id
+  (`/actions/runs/1580`, R-417's offset again) and renders through JavaScript, so its HTML carries every
+  status word as a template string — `grep` finds „success”, „failure”, „running” and „cancelled” on a page
+  whatever the outcome. The conclusion was therefore taken from the **list** page, and from the *same*
+  `flex-item` row container that holds the commit link: `flex-item-leading` carries the icon,
+  `flex-item-main` the „gates.yml #849” label and the `/commit/796a9fdf40` link. Splitting the list on
+  `class="flex-item` does **not** work — the child divs share that prefix, so the row gets chopped and the
+  icon is attributed to a neighbour. Reading the icon off a neighbouring row is exactly how a red run gets
+  reported green, so it is written down.
 
 ## 10. Teardown