Classify Python dependency manifests in merge preflight

[lamemustafa]

Root cause

Dependency justification checks recognize npm and Cargo manifests but not Python dependency manifests installed from a workflow.

Rectification

Classify supported Python dependency manifests and their installation declarations before accepting workflow documentation.

Regression check

python3 scripts/merge-gate.test.py

Scope

Deferred from PR #335 under the owner-approved P1-only merge stopping rule.

[lamemustafa]

Closed by #335, now merged. The code this issue describes no longer exists on master.

The merge-gate tooling was cut from 3,977 lines to 1,847. Deleted wholesale: PR/head/base identity binding, branch-protection context derivation and the checks rollup; the final identity fence that re-validated all of it a second time; the PR-body, review-checklist, permalink, P4-template and platform-evidence validators; the skipped-CI-job allowlist and its rename-path handling; the separate security-reviewer-comment validation; and scripts/merge_gate_fake_gh.py.

Verified against origin/master rather than asserted: validate_skipped_ci_jobs, validate_security_reviewer, body_has_p4_answers, body_has_platform_evidence, read_review_checklist, checklist_link_ok and body_has_validation_command are all absent from scripts/merge-gate.sh.

What remains — compatibility-surface validation, the privacy/PII scan, and a minimal check that a review exists naming the current head SHA — is promoted from a manual CLI tool to a required CI check, which is the thing the old tooling never actually did.

This was a real finding. It is closed because the surface carrying it is gone, not because it was judged unimportant. If the smaller replacement reintroduces an analogous gap, please raise it fresh against the new implementation.