gate guard, runtime spec, Node 24 actions

CHANGELOG.md

@@ -128,6 +128,25 @@ ADR-007 and ADR-002.
 
 ### Fixed
 
+- **The published site's API documentation page had no spec to show.**
+  `shopdb/core/api/docs.py` reads `docs/openapi.json` at runtime to serve
+  `/api/docs`, and publication excluded the whole of `docs/` because the prose
+  becomes the wiki. So every site installed from the published repo shipped the
+  ReDoc page, loaded it, and answered `{"error":"openapi.json not generated"}`.
+  The spec now publishes: it is a product file that happens to live under
+  `docs/`, not documentation. The prose still goes to the wiki and nowhere else.
+
+- **Three gates were reporting green by not running.**
+  `test_api_inventory_parity`, `test_openapi_spec` and `test_docs_publishable`
+  all skip themselves when the file they read is absent - correct in a
+  published checkout, and silently wrong on GitHub, which runs against exactly
+  that checkout. An outside branch added nine routes documented nowhere and
+  passed CI. `scripts/check-gates-ran.sh` now asserts each gate actually ran,
+  splitting the ones that must run everywhere from the ones that need files
+  publication deliberately leaves behind, and a new `gates` job runs it in CI.
+  Verified in both directions: it passes here, and it fails when the file a
+  gate reads is taken away.
+
 - **Secure Send now hands you a message, not a bare URL.** A link on its own
   invites being pasted onto text already sitting in the chat box, and a chat
   client turns the selection into the link's caption - so the secret travels as