feat(hydra-gates): gate 109 accepts a slug owned by a sibling app, and verifies it

[rubenvdlinde]

What changes

Gate 109 (seed-required-slugs) now lets an e2e seed require a schema slug that another app owns, and checks the claim instead of trusting it.

The seed names the owner on a line of its own, in the same hydra-gate-<n> <verb>: shape as the hydra-gate-98 held: marker:

# hydra-gate-109 external: decision-table owner=openregister

The gate then verifies three things:

• The owner is in the app's CI additional-apps or e2e-additional-apps.
• The owner's descriptors (lib/Settings, tests/e2e, appinfo, merged-view resolution like the app's own) declare the slug.
• If the owner cannot be read, the gate fails and names what it could not read. It never passes because the check did not run.

Also:

• An annotation the seed does not need (slug not required, or the app declares it itself) is printed as STALE and does not fail.
• A hydra-gate-109 line that does not parse fails, so a typo in the directive is not silently ignored.
• An unannotated slug fails with the same message as before.

Where the gate reads the owner from in CI

The Hydra Gates job checks out one repository, so it could not see a sibling. quality.yml now clones the caller's additional-apps and e2e-additional-apps into $RUNNER_TEMP/gate-siblings/<app> at the refs the caller installs, and hands the gate:

• HYDRA_GATE_ADDITIONAL_APPS: both lists as JSON, passed even when empty, so "installs nothing" and "was not told" stay different answers.
• HYDRA_GATE_SIBLINGS_DIR: where the clones are.

A failed clone only warns. The gate fails, naming the owner and directory, and only when an annotation depends on it. The job now declares permissions: contents: read and sets persist-credentials: false on both checkouts, as every other job that clones sibling apps does (keepiq#881). assert-sibling-jobs-read-only-token.py passes, including its positive control.

An older pinned gate package ignores the two variables, so nothing changes for callers until they move hydra-gates-ref.

Verified

• test_check_seed_required_slugs.py: exit 0. New arms, each with a control that flips one thing: declared by owner passes (misspelt owner slug and misspelt annotation slug fail), owner unreadable fails (no dir, missing dir, no descriptors), additional-apps not provided or empty or missing the owner fails, stale annotation reported, unannotated slug fails with the original message, malformed directive fails.
• check_gate_numbers_unique.sh: exit 0.
• tests/test-hydra-gates-bin.sh: exit 0.
• shellcheck on the new workflow step: clean.
• Against buildiq#1100 with openregister development checked out: passes with the annotation, fails without it, fails with decision-tabel, fails with an empty siblings dir.

Not covered

• The gate reads the owner's descriptors only. It cannot tell whether the owner's schema is imported at runtime, only that it is declared.
• Callers need a hydra-gates-ref that includes this change before an annotation counts.

Next step: merge, tag a gates release, then buildiq#1100 can pass gate 109 once it moves its pin.