CI: give the golden-currency gate the sibling clone it needs, instead of letting it skip

CI checks out ONE repo, shallow. The R-242 gate reads the newest RELEASED
controller from the sibling clone's CHANGELOG.md - the same sibling assumption
reuse_refs_check.py and instructions_gate.py already make - so in CI it was
exiting 2 (INCONCLUSIVE) and CI went red on every push.

Caught by checking the CI result rather than assuming it: runs 241, 242 and
243 all failed while the gates were green locally.

A PERMANENTLY-RED CI IS THE DETECTOR-NOBODY-HEARS FAILURE THIS WORKFLOW EXISTS
TO PREVENT - people stop reading it, and then it catches nothing. So the fix
is to give the gate what it needs, not to let it skip when the sibling is
absent: a skip would be the fail-open shape this project keeps removing, and
the gate would then run in NEITHER of its two automated homes (the pre-push
hook and CI).

Depth 1, pinned to main, plain git - no JavaScript-action step, per the
workflow's own rule about the runner having python3 and git and nothing else.
If the fetch fails the gate still reports INCONCLUSIVE rather than passing.

.gitea/workflows/gates.yml

@@ -32,6 +32,27 @@ jobs:
           git checkout -q FETCH_HEAD
           echo "checked out $(git rev-parse HEAD)"
 
+      - name: Fetch the controller CHANGELOG (golden-currency gate needs the sibling repo)
+        # R-242's gate compares the newest RELEASED controller against the newest golden baked here,
+        # and it reads the released version from the sibling clone's CHANGELOG.md — the same sibling
+        # assumption reuse_refs_check.py and instructions_gate.py already make on a workstation.
+        #
+        # CI checks out ONE repo, shallow, so without this the gate exits 2 (INCONCLUSIVE) and CI is
+        # red for ever. **A permanently-red CI is the detector-nobody-hears failure this whole
+        # workflow exists to prevent**, so the fix is to give the gate what it needs rather than to
+        # let it skip: a silent skip would be the fail-open shape, and the gate would then run in
+        # NEITHER of its two automated homes.
+        #
+        # Depth 1, pinned to main, and only this repo's CHANGELOG is used. If the fetch fails the
+        # gate still reports INCONCLUSIVE rather than passing — not knowing is never a pass.
+        run: |
+          git init -q ../felhom-controller
+          cd ../felhom-controller
+          git remote add origin http://gitea.gitea-system.svc.cluster.local:3000/admin/felhom-controller.git
+          git fetch -q --depth 1 origin main
+          git checkout -q FETCH_HEAD
+          echo "controller CHANGELOG at $(git rev-parse --short=12 HEAD): $(head -1 CHANGELOG.md)"
+
       - name: Run the gate entry point
         # The ONLY thing CI runs. No go build, no go test, no linting, no deploy — those are either
         # already reliably run by a person or none of CI's business. The exit code IS the result: