Prove the gates ran, and ship the spec the app serves

Two faults with one cause: docs/ is excluded from publication because the prose
becomes the wiki, and two things under docs/ are not prose.

shopdb/core/api/docs.py reads docs/openapi.json AT RUNTIME to serve /api/docs.
Excluding it meant every site installed from the published repo shipped the
ReDoc page, loaded it, and got {"error":"openapi.json not generated"}. The spec
now publishes - it is a product file that happens to live under docs/. The prose
still goes to the wiki and nowhere else, and docs/api-inventory.json stays out,
because nothing reads it at runtime.

The second fault is the reason this was worth chasing. Three gate modules skip
themselves when the file they read is absent, which is correct in a published
checkout and silently wrong on GitHub, which runs against exactly that checkout.
The modules skipped, CI reported green, and an outside branch added nine
undocumented routes and passed. A gate that stops running is worse than no gate,
because nobody looks at it again.

scripts/check-gates-ran.sh asserts each gate ran, with two lists: the ones that
must run everywhere, and the ones needing files publication deliberately leaves
behind - required here, allowed to be absent there. A `gates` job runs it in CI.
Proven in both directions: green in each checkout, and red when the file a gate
reads is removed.

Also purge instance/plugins.json from the publication tree. It was never
published - it is untracked there - but an old copy had sat in that tree for
months, protected from --delete by its own exclude, and it made the published
repo fail its own suite locally: 13 plugins enabled where the code expects 16.
A publication tree that cannot pass its own tests cannot be verified before
shipping. That is the exact trap the comment at the top of the script warns
about, which had claimed a second victim.

Also: concurrency on the workflow, so a second push supersedes the first rather
than queueing behind it holding a self-hosted runner.

CHANGELOG.md

@@ -128,6 +128,25 @@ ADR-007 and ADR-002.
 
 ### Fixed
 
+- **The published site's API documentation page had no spec to show.**
+  `shopdb/core/api/docs.py` reads `docs/openapi.json` at runtime to serve
+  `/api/docs`, and publication excluded the whole of `docs/` because the prose
+  becomes the wiki. So every site installed from the published repo shipped the
+  ReDoc page, loaded it, and answered `{"error":"openapi.json not generated"}`.
+  The spec now publishes: it is a product file that happens to live under
+  `docs/`, not documentation. The prose still goes to the wiki and nowhere else.
+
+- **Three gates were reporting green by not running.**
+  `test_api_inventory_parity`, `test_openapi_spec` and `test_docs_publishable`
+  all skip themselves when the file they read is absent - correct in a
+  published checkout, and silently wrong on GitHub, which runs against exactly
+  that checkout. An outside branch added nine routes documented nowhere and
+  passed CI. `scripts/check-gates-ran.sh` now asserts each gate actually ran,
+  splitting the ones that must run everywhere from the ones that need files
+  publication deliberately leaves behind, and a new `gates` job runs it in CI.
+  Verified in both directions: it passes here, and it fails when the file a
+  gate reads is taken away.
+
 - **Secure Send now hands you a message, not a bare URL.** A link on its own
   invites being pasted onto text already sitting in the chat box, and a chat
   client turns the selection into the link's caption - so the secret travels as