Add local:gate, pre-push-gate skill #4871

Part of the agentic software factory tracker #4858, Wave 4. Proposed as S10 in docs/agent-guidance-inception.md (PR #4861) §9, from #4859.

Depends on

After Part 3 (skills infrastructure, for verify:skills:cli), Part 4 (TS gate) and Part 5 (Python gate). All three have landed, so nothing blocks this issue.

It no longer waits on #4854 and #4855. The only piece that needed them was enforcing per-file coverage, which cannot be turned on until their test suites exist. That piece has moved to them (see Out of scope), so the gate and its skill ship now and the spec refactor adds coverage to a gate that already exists.

Scope

• A root npm run local:gate, run under the Inspector's gate-lease.mjs so concurrent sessions queue. It chains:
  • verify:install-fresh first, adapted from the Inspector for the root workspace install only. local:gate never runs npm ci, so without it a stale local node_modules would be tested against dependencies CI doesn't use
  • the TS validate and the Python validate
  • verify:skills:cli
  • a thin boot smoke for each server over each transport it implements: stdio for all seven, plus SSE and Streamable HTTP for everything
  • Adopt MCP interface-diff CI for the everything server (decide on PR #3260) #4860's interface diff. Adopt MCP interface-diff CI for the everything server (decide on PR #3260) #4860 is independent, so whichever of this issue and Adopt MCP interface-diff CI for the everything server (decide on PR #3260) #4860 lands second adds it to local:gate, keeping "every check CI runs" true
• timeout-minutes on every CI job; none declare one today.
• Assert that no tests retry.
• Remove Part 3's temporary verify:skills:cli wiring allowance (local:gate now runs it).
• Port scripts/lib/workflow-gate.mjs and its tests, dropping its lib/headless-browser.mjs import along with the browser-engine rules. (gate-lease.mjs imports lib/win-shell-args.mjs, which Part 3 already ports.) The port ensures no workflow can invoke a local:* script and local:gate stays exactly the lease wrapper.
• Add docs/quality-gate.md and the pre-push-gate skill.
• Add the AGENTS.md rule: the mandatory pre-push gate.

Out of scope: per-file coverage (moved to #4854 and #4855)

This issue used to also wire per-file ≥ 90 coverage into local:gate and CI and write the AGENTS.md coverage rule. That is test-coverage work, and it belongs with the suites that make the threshold reachable:

• Bugs, Coverage, and SDK Wave 1 Part 1: TypeScript servers: extensive unit tests + per-file 90% coverage gate #4854 (TypeScript) adds the thresholds, the parallel coverage job in typescript.yml, the TS coverage stage in local:gate, and the TS half of the AGENTS.md rule.
• Bugs, Coverage, and SDK Wave 1 Part 2: Python servers: extensive unit tests + per-file 90% coverage gate #4855 (Python) adds the per-file check script, the parallel coverage job in python.yml, the Python coverage stage in local:gate, and the Python half of the rule.

local:gate is built here so that a stage can be added to it in one place; docs/quality-gate.md and the pre-push-gate skill describe the stages that exist, and each of those issues adds its stage to both.

Acceptance criteria

• npm run local:gate runs every check CI runs.
• Concurrent gates queue.
• The skill carries eval cases that pass the threshold.
• If this is the first skill-adding PR to merge, remove Part 3's empty-skills bootstrap allowance from verify:skills.

Branch

Targets v2/main. Closes #N won't auto-close an issue on a non-default branch, so close this one by hand on merge and move the card to Done.