fix(gate): fail-open guard, shared osv diff-mode, required-checks rename

Andrew Dunnrequested to merge
wt/gate-fixes into main

What

Three correctness/consistency fixes to the automerge-gate and osv-verdict templates (both new in the pending v4.1.0), recovered from a complete but unpushed local commit and landed before v4.1.0 is tagged.

Fixes

  1. Fail-open guard (the important one). The gate aggregation loop ran under set -uo pipefail with no guard that any check executed. If required-checks rendered empty or was typo'd, the loop body never ran and non-shipping classes fell through to GATE GREEN / exit 0 -- a fail-open hole in a fail-closed gate. Now tracks an evaluated counter and blocks (exit 1) when zero checks were evaluated, before both the customer-shipping floor and the non-shipping path.
  2. Shared osv diff-mode semantics. osv-verdict bare-checked-out the merge-base and full-scanned on shallow-clone miss / base-scan error, blocking on pre-existing findings. Ports ensure_base_reachable (deepen / fetch base SHA / unshallow) and fail-closes when the base stays unreachable, matching the sibling estate catalogs so all three share one diff-mode semantics.
  3. Input-name drift. required_checks (underscore) -> required-checks (hyphen), matching the sibling catalogs; sim consumers and READMEs updated.

Why now

v4.1.0 ships these two templates for the first time. Shipping the automerge-gate with a known fail-open hole would be a defect on its first release, so this lands first; the v4.1.0 tag follows.

Verification

  • Fail-open guard reviewed: blocks (exit 1) when evaluated == 0, ahead of both gate paths.
  • Templates validate as multi-document YAML; no required_checks (underscore) remains anywhere.

Merge request reports