feat(#2008): generic command-exit-zero gate-predicate evaluator (#2011)

* feat(#2008): add generic command-exit-zero gate-predicate evaluator

Third-party capability gates declared via check.predicate were rendered for
display but never evaluated (only built-in check.query gates fired; the
security capability's gate worked solely via a hard-coded ship.md branch).

Add a generic, deps-injected gate-predicate evaluator (src/gate-predicate-evaluator.cts)
that dispatches by predicate.kind. Built-in kind: command-exit-zero — runs a
bounded sh -c command at the project root (via shell-command-projection.execTool),
inherits env, exit 0 => pass, non-zero => block, timeout => block, fail-closed.

Wire a 'check predicate' subcommand into check-command-router.cts and extend
the three generic workflow gate-dispatch sites (execute:wave:post, execute:post,
plan:post) to route check.predicate gates to the new evaluator. The two-step
gate contract (command-failure => onError; block => halt) is unchanged.

- src/gate-predicate-evaluator.cts: pure leaf, KIND_TABLE extensible
- src/check-command-router.cts: cmdCheckPredicate + buildPredicateDeps + parsePredicateFlags
- docs/adr/2008-*, docs/reference/gate-predicates.md, docs/how-to/command-exit-zero-gate.md
- tests: 38 unit + integration tests (exit mapping, timeout, interpolation,
  property-based bijection, malformed-predicate fail-closed, real subprocess e2e)

Closes #2008

* docs(#2008): backfill changeset pr number 2011

tests/fixtures/golden-install-parity/opencode.json

@@ -298,7 +298,7 @@
   "gsd-core/workflows/docs-update.md": "93e969c3afb446a0",
   "gsd-core/workflows/edit-phase.md": "ed948a400a0146c7",
   "gsd-core/workflows/eval-review.md": "1ba1af74a43c07db",
-  "gsd-core/workflows/execute-phase.md": "f0ca3839e0d0cf8b",
+  "gsd-core/workflows/execute-phase.md": "24561c1fbc7b710e",
   "gsd-core/workflows/execute-phase/steps/codebase-drift-gate.md": "a640b093a5a7b028",
   "gsd-core/workflows/execute-phase/steps/per-plan-worktree-gate.md": "7ebb7d1af6082028",
   "gsd-core/workflows/execute-phase/steps/post-merge-gate.md": "8b42f5df1a2c231f",
@@ -334,7 +334,7 @@
   "gsd-core/workflows/note.md": "0d1374f2a2257858",
   "gsd-core/workflows/pause-work.md": "c9f0b8826845dda7",
   "gsd-core/workflows/plan-milestone-gaps.md": "5ec459734bf7570c",
-  "gsd-core/workflows/plan-phase.md": "03745f51d63d99b8",
+  "gsd-core/workflows/plan-phase.md": "f449b7d8f334ebb9",
   "gsd-core/workflows/plan-phase/steps/closed-phase-gate.md": "4099ef6d0868de60",
   "gsd-core/workflows/plan-phase/steps/prd-express-path.md": "fa7f29c323f4cb57",
   "gsd-core/workflows/plan-phase/steps/windows-troubleshooting.md": "e9de7a96bbfff261",