ci: Wire ASVS gate workflow on PRs targeting master

Author: thced

.github/workflows/asvs-gate.yml

@@ -0,0 +1,24 @@
+name: OWASP ASVS gate
+
+on:
+  pull_request:
+    branches: [master]
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  asvs-checklist:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Enforce ASVS re-affirmation on TLS code changes
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: .github/scripts/asvs-gate.sh

docs/superpowers/plans/2026-05-21-owasp-asvs.md

@@ -382,7 +382,7 @@ SKIP=commitlint git commit -m "ci: Add ASVS re-affirmation gate script"
 
 - Create: `.github/workflows/asvs-gate.yml`
 
-- [ ] **Step 1: Write the workflow**
+- [x] **Step 1: Write the workflow**
 
 Write `.github/workflows/asvs-gate.yml`:
 
@@ -413,7 +413,7 @@ jobs:
         run: .github/scripts/asvs-gate.sh
 ```
 
-- [ ] **Step 2: Lint the workflow file**
+- [x] **Step 2: Lint the workflow file**
 
 The repo has pre-commit hooks including yamllint. Run them against the new file:
 
@@ -423,7 +423,7 @@ pre-commit run --files .github/workflows/asvs-gate.yml
 
 Expected: all hooks pass.
 
-- [ ] **Step 3: Commit**
+- [x] **Step 3: Commit**
 
 ```bash
 git add .github/workflows/asvs-gate.yml