CI-level gate

Done-gate and the design judge fire in the loop that produces my work. A teammate's session that never loads them can still open a PR — the gate is a habit, not a check.

Gating at generation only scales if generation is the only way in. At team scale, merge is the chokepoint everyone actually shares.

Package the judge and the done-gate checklist as a CI check on pull requests, reading the same rules source the sessions do — one rules store, two enforcement points. A PR that fails the judge gets the same findings report a session would.