feat(#1169): wire ship:pre security gate via render-hooks (ADR-857 phase 6)

Part of the ADR-857 phase-6 migration (#1169, epic #857) — not a shipped bug fix. The capability system (registry, render-hooks, gates, capability-state) lives only on next / 1.5.0-rc; npm latest is 1.4.5 and contains none of it, so no released user can hit this.

The security capability declares a blocking gates@ship:pre hook (when=workflow.security_enforcement, predicate SECURITY.md.threats_open==0), but ship.md never called `loop render-hooks ship:pre` and had no inline fallback, so the declared gate never fired. Wire it into ship.md preflight_checks via the render-hooks idiom — fail-closed: the ship blocks unless threats_open is exactly 0.

Add a phase-6 conformance assertion that every declared hook point has a render-hooks call site; execute:wave:post (ui_safety_gate) stays in KNOWN_UNWIRED pending its unimplemented ui.safety-gate check.

Part of #1169. Refs #857.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/workflow-size-baseline.json

@@ -69,7 +69,7 @@
   "settings-advanced.md": 39621,
   "settings-integrations.md": 15801,
   "settings.md": 32133,
-  "ship.md": 20896,
+  "ship.md": 22534,
   "sketch-wrap-up.md": 14223,
   "sketch.md": 19960,
   "spec-phase.md": 23094,