gates: one entry point (scripts/repo_gates.py) + pre-push hook

A census of all thirteen gate scripts across the four felhom repos on 2026-08-02 found one
clean correlation: every check a CLAUDE.md tells a person to run was passing, and two of the
four nobody is told to run were failing — one since 14 July. Neither failure was harmful in
effect (checked line by line); nothing would have said so if they had been. The fix is not
more gates, it is one place to run them from.

repo_gates.py runs site + hostinstall + hub-confirm + manifest-bearer + reuse-refs, streams
each gate's own output, and exits worst-wins non-zero. A missing gate script is a FAILURE and
prints the path tried — fail-closed, because a runner that quietly skips a gate is the
inert-seam failure this project has shipped four times. It copies catalog_gates.py (R-161),
NOT site_gates.py, which is a gate and not a runner.

.githooks/pre-push runs it with --fast and refuses the push. Honest limits are written into
the hook itself: per-clone (core.hooksPath is local config), and --no-verify bypasses it on
purpose. Any manual run WARNS when the clone is unarmed. Measured on git 2.47.3: a relative
core.hooksPath resolves correctly and the hook's cwd is the repo root from any subdirectory.

test_repo_gates.py is a SEAM test — it asserts each member gate's own distinctive stdout, not
the runner's summary line, which an inert runner prints while calling nothing. Red-proofed:
replacing run_gate's body with 'return 0' still prints 'all felhom.eu gates OK' and exits 0,
and turns the seam test red.

CLAUDE.md

@@ -174,11 +174,33 @@ Steps: commit+push code → `cd /mnt/5_hdd/felhom.eu/build/felhom-hub && ./build
 (local) → bump `manifests/hub.yaml` tag + push → ArgoCD hard-refresh + sync (kubectl-patch method in
 the skill, now local `sudo kubectl`) → verify Synced/Healthy + rollout + image + startup log.
 
+## Gates — ONE entry point
+
+**Run `python3 scripts/repo_gates.py` after ANY change in this repo.** It is the one entry point
+and runs every gate — `site_gates.py`, `hostinstall_gates.py`, `hub_confirm_gate.py`,
+`manifest_bearer_gate.py` and `reuse_refs_check.py` on this root — streaming each gate's own output
+and exiting non-zero if any fails. `--fast` selects only the gates that touch no network and no
+container runtime; today that is all of them. A missing gate script is a FAILURE, never a skip.
+
+**Why a runner and not five invocations** (2026-08-02, R-29): a census of all thirteen gates across
+the four repos found that every check a `CLAUDE.md` names was passing, and two of the four nobody
+is told to run were failing — one since 14 July. The single-entry-point shape is the only one that
+demonstrably gets run here; `app-catalog-felhom.eu/scripts/catalog_gates.py` is the canonical
+version of it (R-161) and `repo_gates.py` copies it. `site_gates.py` is a *gate*, not a runner —
+do not model new work on it.
+
+**The pre-push hook.** `.githooks/pre-push` runs `repo_gates.py --fast` and refuses the push if it
+fails. It is **per-clone** and switched on once with `git config core.hooksPath .githooks` — a
+clone does not carry it, and any manual `repo_gates.py` run WARNS when this clone is unarmed.
+`git push --no-verify` bypasses it deliberately; **say so in the session report when you use it**.
+Both facts are why continuous integration is still owed (`OPEN-ITEMS.md` R-168) — this hook is
+local and skippable, and only CI is neither.
+
 ## Build & deploy — Website / Manifests
 
-- **Website** auto-deploys via git-sync; just push to `main` (live in 1–2 min). **Run
-  `python3 scripts/site_gates.py` after ANY website change**; new pages go into its `PAGES` list.
-  Emergency edits: https://files.felhom.eu. All `website/` HTML is **UTF-8 with BOM** — preserve it.
+- **Website** auto-deploys via git-sync; just push to `main` (live in 1–2 min). Website changes go
+  through `repo_gates.py` above (it runs `site_gates.py`); new pages go into that gate's `PAGES`
+  list. Emergency edits: https://files.felhom.eu. All `website/` HTML is **UTF-8 with BOM** — preserve it.
 - **Manifests** are GitOps via the `felhom` app — commit to `main`, then deliberate sync.
 
 ## Key patterns