chore: address Copilot review round 14

- The CI wiring vouch accepted any syntactically-executable `run:`, so a step
  moved into a release-only job or put behind `if: false` still reported as
  wired while PR CI validated nothing. It now requires an UNCONDITIONAL step:
  any `if:` on the job or the step disqualifies it, since this guard cannot
  evaluate an Actions expression and "runs sometimes" is not the property being
  asserted. Seven predicate cases, including the two conditional shapes and a
  multi-line `run:` that must still count.
- The `local:gate` stage list now has one owner, `docs/quality-gate.md`. It had
  three copies, and they drifted apart across rounds 5, 6 and 8 of this review —
  which is the argument the PR itself is making, applied to itself.

Signed-off-by: cliffhall <cliff@futurescale.com>

.claude/skills/pre-push-gate/SKILL.md

@@ -23,8 +23,12 @@ npm run format      # auto-fix: core/, scripts/, the shared surface, every clien
 npm run local:gate  # several minutes
 ```
 
-`local:gate` is `validate` → `verify:skills:cli` → `coverage` → `verify:build-gate` →
-`verify:bundle-externals` → `smoke` → `smoke:web:firefox` → `local:storybook`.
+The stages it runs, in order, are listed in
+[`docs/quality-gate.md`](../../../docs/quality-gate.md) — deliberately in one
+place only. That list drifted apart across three copies while this PR was in
+review, which is the argument for not making a fourth. `npm run local:gate`
+prints each stage as it starts, so the running command is the other reliable
+answer.
 
 It is a **strict superset** of GitHub CI (which additionally runs `npm install`,
 and runs `coverage` as a parallel job). So the direction that matters holds: