feat(#2008): generic command-exit-zero gate-predicate evaluator (#2011)

* feat(#2008): add generic command-exit-zero gate-predicate evaluator

Third-party capability gates declared via check.predicate were rendered for
display but never evaluated (only built-in check.query gates fired; the
security capability's gate worked solely via a hard-coded ship.md branch).

Add a generic, deps-injected gate-predicate evaluator (src/gate-predicate-evaluator.cts)
that dispatches by predicate.kind. Built-in kind: command-exit-zero — runs a
bounded sh -c command at the project root (via shell-command-projection.execTool),
inherits env, exit 0 => pass, non-zero => block, timeout => block, fail-closed.

Wire a 'check predicate' subcommand into check-command-router.cts and extend
the three generic workflow gate-dispatch sites (execute:wave:post, execute:post,
plan:post) to route check.predicate gates to the new evaluator. The two-step
gate contract (command-failure => onError; block => halt) is unchanged.

- src/gate-predicate-evaluator.cts: pure leaf, KIND_TABLE extensible
- src/check-command-router.cts: cmdCheckPredicate + buildPredicateDeps + parsePredicateFlags
- docs/adr/2008-*, docs/reference/gate-predicates.md, docs/how-to/command-exit-zero-gate.md
- tests: 38 unit + integration tests (exit mapping, timeout, interpolation,
  property-based bijection, malformed-predicate fail-closed, real subprocess e2e)

Closes #2008

* docs(#2008): backfill changeset pr number 2011

tests/workflow-size-baseline.json

@@ -24,7 +24,7 @@
   "docs-update.md": 55662,
   "edit-phase.md": 12883,
   "eval-review.md": 9923,
-  "execute-phase.md": 93515,
+  "execute-phase.md": 93484,
   "execute-plan.md": 32611,
   "explore.md": 10497,
   "extract-learnings.md": 12849,
@@ -52,7 +52,7 @@
   "note.md": 6563,
   "pause-work.md": 14397,
   "plan-milestone-gaps.md": 11765,
-  "plan-phase.md": 89775,
+  "plan-phase.md": 90411,
   "plan-review-convergence.md": 23468,
   "plant-seed.md": 11741,
   "pr-branch.md": 15919,