feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined (#14774)

* wip: whole-tree-population channel

* wip: self-test repairs

* wip: hoist self-test helper

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]

scripts/check-closing-keyword-parity.mjs

@@ -95,6 +95,8 @@
  * pinning an unmeasured spelling here would launder a guess into a contract.
  */
 
+// dispatch-gates: whole-tree-population -- the sweep reads every tracked file (node_modules and dist aside) hunting the closing-keyword grammar, so a card adding prose or a workflow anywhere implicates it; the literals below are the parsers it grades.
+
 import { execFileSync } from 'node:child_process';
 import { readFileSync, statSync } from 'node:fs';
 import { join } from 'node:path';

scripts/check-comment-mask-corpus.mjs

@@ -123,6 +123,8 @@
  * run.
  */
 
+// dispatch-gates: whole-tree-population -- `collectSources` walks every authored JS/TS file from the repo root, so the corpus is the whole tree; the one literal below names the masker this gate exercises, not the files it reads.
+
 import { readdirSync, readFileSync } from 'node:fs';
 import { dirname, extname, join, relative, resolve } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';

scripts/check-nul-bytes.mjs

@@ -264,6 +264,8 @@
 // on purpose. Extraction failure is RED, never a silent skip -- the class
 // vanishing from a self-scan command is the same defect as it drifting.
 
+// dispatch-gates: whole-tree-population -- the scan set is `git ls-files` PLUS `git ls-files --others --exclude-standard`, so every tracked and every untracked-not-ignored file in the repo is read; the literals below name this gate's own artifacts, never its population.
+
 import { execFileSync } from 'node:child_process';
 import { lstatSync, mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';

scripts/check-refd-timer-probe.mjs

@@ -95,6 +95,8 @@
  * never stand for "there was nothing to find".
  */
 
+// dispatch-gates: whole-tree-population -- `readTree` is the tracked-plus-untracked sweep of the entire repository, so no card's file surface can narrow this gate; the literals below are its skip set and its testkit anchor.
+
 import { readFileSync } from 'node:fs';
 import { execFileSync } from 'node:child_process';
 import { join, dirname, resolve, relative, sep } from 'node:path';

scripts/check-watch-hint-literal.mjs

@@ -139,6 +139,8 @@
  * directly after a `const` in this file.
  */
 
+// dispatch-gates: whole-tree-population -- `audit(walk(REPO_ROOT))` reads every authored JS/TS file in the tree; ROOT_DIR_WATCH_HINTS below is where this gate's FINDINGS have so far lived, not the population it walks.
+
 import { readdirSync, readFileSync, statSync } from 'node:fs';
 import { dirname, relative, resolve, join } from 'node:path';
 import { fileURLToPath } from 'node:url';