v5.3.1: automerge-gate fail-open guard + osv-verdict merge-base reachability

- automerge-gate now blocks (exit 1) when zero required checks were
  evaluated (empty/typo'd required-checks no longer fail-OPENs to GREEN).
- Bundles the osv-verdict merge-base reachability fixes that were on main
  since v5.3.0 but never tagged (v5.3.0 was 6 commits behind main).
- All template image pins bumped to v5.3.1.