Rectify composite-action workflow evidence requirements

[lamemustafa]

Problem

Changes to .github/actions/setup-windows-native/action.yml, including renames, are not classified as workflow changes. The gate therefore does not require rollback and migration notes even though CI and packaging jobs invoke that action.

Acceptance

• Classify the local Windows setup composite action and its prior rename path as workflow changes.
• Require existing workflow rollback and migration evidence.
• Add direct and rename controls.

Regression source

Discovered during review of PR #335. Follow up in a dedicated type:rectify PR after #335 merges; do not reopen the current P1-only batch.

[lamemustafa]

Closed by #335, now merged. The code this issue describes no longer exists on master.

The merge-gate tooling was cut from 3,977 lines to 1,847. Deleted wholesale: PR/head/base identity binding, branch-protection context derivation and the checks rollup; the final identity fence that re-validated all of it a second time; the PR-body, review-checklist, permalink, P4-template and platform-evidence validators; the skipped-CI-job allowlist and its rename-path handling; the separate security-reviewer-comment validation; and scripts/merge_gate_fake_gh.py.

Verified against origin/master rather than asserted: validate_skipped_ci_jobs, validate_security_reviewer, body_has_p4_answers, body_has_platform_evidence, read_review_checklist, checklist_link_ok and body_has_validation_command are all absent from scripts/merge-gate.sh.

What remains — compatibility-surface validation, the privacy/PII scan, and a minimal check that a review exists naming the current head SHA — is promoted from a manual CLI tool to a required CI check, which is the thing the old tooling never actually did.

This was a real finding. It is closed because the surface carrying it is gone, not because it was judged unimportant. If the smaller replacement reintroduces an analogous gap, please raise it fresh against the new implementation.