✅ test(release): restore the changelog gate — main is red on a vacuous note grep and a subject-shaped merge proof

[konih]

main is red: the release-exitgate job's AUD-S18 audit exit gate runs task check, which dies in release-changelog-gate-test. Two distinct defects, one commit each.

1. §1/§6 — the D-120 note grep was vacuous

The greps keyed on the bare token pins.toolDigest. That token is not header-unique: two commit subjects inside the [0.2.0] section carry it verbatim (warn record consumers that pins.toolDigest changed value, derive pins.toolDigest from Go build info), and cliff.toml names it again in the D-121 note. So the grep matched the rendered body and passed whether or not the header note survived.

§6's polarity control detected precisely this and failed closed — the control did its job. Fixed by anchoring on the header sentence pins.toolDigest` changes value after. Measured, not reasoned:

render	bare token	header anchor
--latest	4	1
--latest --strip header	2	0

2. §7a — the merge-skip proof was keyed on subject text

D-136 skips merges by commit shape (merge_commit = true), but 7a asserted every bullet only the mutant renders starts with - Merge . Real history now carries a merge with a conventional gitmoji subject — 41a3072 :twisted_rightwards_arrows: chore(aud-s18): merge AUD-S13 (PR #35), landed with #38 — which is skipped correctly and was misread as an over-skip. That case is exactly the accepted cost §7b already pins in its sandbox.

Now keyed on membership in git log --merges, which is also strictly stronger in the other direction: an ordinary commit merely titled "Merge …" would have satisfied the old grep and now fails.

Gates

• bash hack/release/changelog_gate_test.sh — exit 0, all 8 sections, both polarities
• CI=true bash hack/audit/exitgate_test.sh — exit 0, all 14 stages (this runs a full task check)

Run locally because release-exitgate is skipping on pull requests — PR CI will not exercise either gate. That is RELSE-08, and it is why #38 merged green and reddened main.