chore: run each client's test suite once in local:gate, not twice (#2341)

`local:gate` ran every client's unit suite bare inside `validate` and
again instrumented inside `coverage` — ~80s of a ~370s run re-executing
exactly the files the coverage pass runs a few minutes later. CI pays
nothing for that duplication because its two jobs run in parallel; the
gate runs serially, so it paid all of it.

The gate's first stage is now `local:validate`: the same `validate:guards`
and `validate:core`, then each client's new `check` script (`format:check`
+ `lint` + `typecheck` + `build`) instead of its `validate`, which is now
literally `check && test`. `npm run validate` and both CI jobs are
unchanged; `local:validate` sits in the `local:` namespace so the
workflow guard keeps it out of CI by construction.

The "strict superset" claim in AGENTS.md is reworded to what is now
true — every CI *check*, not every CI *invocation* — with the reasoning:
`@vitest/coverage-v8` reads V8's precise-coverage profiler and rewrites
no source, so the instrumented pass runs byte-identical code and is only
slower, the stricter direction for the failure class this repo sees.

Measured on the same worktree: 370s -> 262s wall (EXIT=0 both), the
four removed legs summing to 78.5s in the baseline run's own profile.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PsmUAZ6aLUAFqenjJKSSRp
Signed-off-by: cliffhall <cliff@futurescale.com>

scripts/lib/workflow-gate.mjs

@@ -7,9 +7,11 @@
  *     two verify gates, `smoke` and the Storybook tests. `npm run smoke` covers
  *     `smoke:launcher`, `smoke:cli`, `smoke:tui`, `smoke:web` and
  *     `smoke:web:chromium` — all of which BELONG there.
- *   - **`npm run local:gate`**, the pre-push gate, is a strict superset: it adds
- *     the **Firefox** engine pass, and `smoke:tui` really runs there rather than
- *     self-skipping. WebKit is on demand and belongs to neither tier.
+ *   - **`npm run local:gate`**, the pre-push gate, runs every check CI runs and
+ *     adds the **Firefox** engine pass, and `smoke:tui` really runs there rather
+ *     than self-skipping. WebKit is on demand and belongs to neither tier. It
+ *     runs each client's unit suite once (instrumented, under `coverage`) via
+ *     `local:validate`, where CI's two parallel jobs run it twice (#2341).
  *
  * The narrow thing that must never reach CI is a **non-Chromium engine pass**.
  * `smoke:web:firefox` was placed in the local gate on purpose (#2086,