chore(scripts): rename the local pre-push gate off ci, and guard it out of CI (#2146)

The root `ci` script was never what runs in GitHub CI, and the name worked
against us three ways: it collides with the built-in `npm ci` (which does
something else entirely and is one keystroke away), it invites the
cross-engine passes into a workflow by looking like the thing a workflow
should call, and it blurs "GitHub CI" and "the local gate" in every doc
that names it.

- Rename `ci` → `local:gate` and `ci:storybook` → `local:storybook`, with
  no back-compat alias: `npm run ci` now fails with npm's missing-script
  error, which prints the available scripts.

- Add `scripts/lib/workflow-gate.mjs` + its `test:scripts` suite, which
  runs over the repo's real `.github/workflows/**` and fails on an
  invocation of a `local:*` script, of a non-Chromium engine pass (derived
  from SUPPORTED_BROWSERS), or of `smoke:web:engine`, or on `SMOKE_BROWSER`
  set to anything but a literal `chromium`. It does not forbid
  `npm run smoke`, `smoke:web:chromium` or `smoke:tui` — those belong in CI
  and are there today. Comments are not scanned, so the workflow can still
  explain itself. This is the durable half; the rest is prose.

- Document the two-tier model once, in the root README ("Two tiers: GitHub
  CI and the local gate"), and point the other docs at it rather than
  restating the split.

- Sweep the ~40 stale references across README, AGENTS.md,
  .github/copilot-instructions.md, the client READMEs, the roadmap doc and
  the script headers. AGENTS.md and copilot-instructions.md change
  together, per the mirror rule.

No gate changes what it actually runs.

Signed-off-by: Cliff Hall <cliff@futurescale.com>
Signed-off-by: cliffhall <cliff@futurescale.com>

scripts/verify-build-gate.mjs

@@ -13,7 +13,7 @@
  *
  * This temporarily injects a `node:fs` import into the browser entry
  * (src/main.tsx), runs `vite build`, and asserts the build FAILS with the #1769
- * error, then restores the entry. Run from `npm run ci`.
+ * error, then restores the entry. Run from `npm run local:gate` and from GitHub CI.
  *
  * Why the REAL config + entry (and not a fast throwaway temp entry / generated
  * config): building the actual `clients/web` config is what catches config-level
@@ -350,7 +350,7 @@ if (!output.includes(ERROR_PREFIX)) {
 // so PROBE_MODULE must appear. Without this, a repo that already leaks a built-in
 // would report OK even if the probe was tree-shaken or entryPath went stale —
 // branch (c)'s failure, silently inverted into a pass. (Unreachable inside
-// `npm run ci`: `validate`'s `build:web` fails first on a pre-existing leak — but
+// `npm run local:gate`: `validate`'s `build:web` fails first on a pre-existing leak — but
 // this script is a documented standalone command, run exactly when debugging one.)
 if (!output.includes(PROBE_MODULE)) {
   fail(