ci(R-1297 A): heavy suites by path on a branch push, all on a tag and nightly; no second full gate run

- script_tests_gate.py: test_gate_decoys / test_due_checks_gate / dooplex-offsite run on a CI branch push only
  when one of their paths changed (FELHOM_CHANGED_FILES); no list, an empty or unreadable list = every suite
- gates.yml: nightly schedule 03:20 UTC; the list is set only for push:refs/heads/*; a trimmed commits array
  (total_commits > listed) is an unknown list
- test_repo_gates.py and test_due_checks_gate.py group G drive the real runner with GATES narrowed to their
  labels, instead of the whole gate set a second time (130 s each in CI)
- red-proved: filter cases, workflow pins (old gates.yml), inert run_gate, unregistered due-checks

scripts/test_due_checks_gate.py

@@ -199,9 +199,21 @@ def test_g_gate_is_registered_in_the_runner():
     repo_gates.py's source would also match a commented-out line, which is precisely the
     failure mode being guarded against.
     """
-    p = subprocess.run([sys.executable, RUNNER, "--fast"],
-                       capture_output=True, text=True, cwd=ROOT)
-    out = p.stdout + p.stderr
+    # R-1297 (A, 2026-10-26): the SAME runner (`main`, the real run_gate), its GATES table narrowed to the
+    # entries labelled due-checks — taken from the real table, so a commented-out registration still leaves
+    # nothing to run and every check below fails. It used to run the whole gate set again (~130 s in CI).
+    import io
+    sys.path.insert(0, HERE)
+    import repo_gates
+    saved, real, buf = repo_gates.GATES, sys.stdout, io.StringIO()
+    try:
+        repo_gates.GATES = [g for g in saved if g[0] == "due-checks"]
+        sys.stdout = buf
+        repo_gates.main(["--fast"])
+    finally:
+        sys.stdout = real
+        repo_gates.GATES = saved
+    out = buf.getvalue()
     check("G: runner names the due-checks gate in its output", "due-checks" in out)
     check("G: runner reports a verdict line for it",
           any(l.strip().startswith("due-checks") and ("OK" in l or "FAILED" in l