publish the runtime spec; gate guard

.github/workflows/ci.yml

@@ -1,9 +1,11 @@
 # CI for shopdb-flask on GitHub Actions.
 #
-# Mirrors the internal CI pipeline. Four jobs on push + pull_request:
+# Mirrors the internal CI pipeline. Jobs on push + pull_request:
 #   backend          - pytest (SQLite via TestingConfig, no DB service needed)
 #   naming           - the CONTRIBUTING.md naming/style gate
+#   gates            - proves those checks actually RAN rather than skipping
 #   frontend         - vitest + Vue build
+#   lean-build       - ADR-013: a per-site build carries only its plugins
 #   migrations-mysql - the REAL multi-site deploy path: fresh flask db upgrade
 #                      + every plugin's chain on utf8mb4 MySQL 8, idempotent on
 #                      a second run. The pytest suite only exercises SQLite
@@ -22,6 +24,12 @@ on:
   push:
   pull_request:
 
+# A second push supersedes the first: the older run answers a question nobody is
+# asking any more, and it holds a self-hosted runner while doing it.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   backend:
     runs-on: arc-runner-set
@@ -40,6 +48,24 @@ jobs:
       - uses: actions/checkout@v4
       - run: bash scripts/check-naming-and-style.sh
 
+  gates:
+    # Prove the gates RAN. Several skip themselves when the file they read is
+    # absent, which is correct in this checkout (docs/ becomes the wiki) and was
+    # silently wrong here for months: the modules skipped, CI went green, and an
+    # outside branch added nine routes documented nowhere and passed.
+    #
+    # A gate that stops running is worse than no gate, because nobody looks at
+    # it again.
+    runs-on: arc-runner-set
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.14'
+          cache: pip
+      - run: pip install -r requirements-dev.txt
+      - run: bash scripts/check-gates-ran.sh
+
   frontend:
     runs-on: arc-runner-set
     defaults: