fix(ci): lint the whole repository in the docs-phase gate

[forkwright]

Refs #1

What was wrong

The pipeline ran two scoped commands:

stages = ["ci-config-lint", "readme-lint"]
cmd = "kanon lint --workflow .kanon-ci.toml"
cmd = "kanon lint --writing README.md"

They certify the CI file and the README — the two files least likely to have drifted — and nothing else. kanon lint . reported four violations the gate never looked at. A required check that samples is not a proof surface.

Change

repo-lint runs kanon lint ., which subsumes the scoped workflow check. readme-lint stays, because --writing applies prose rules the default pass does not; it is additive, not substitutive.

Turning the gate on surfaces the four violations it was hiding, all fixed here:

rule	file
CONTEXT/preamble-required	AGENTS.md — no defers_to, no tightens
CONTEXT/preamble-required	CLAUDE.md — no preamble at all
YAML/missing-permissions	.github/workflows/gate-attestation.yml
YAML/missing-concurrency	.github/workflows/gate-attestation.yml

The preambles use the fleet's prose form (defers_to: kanon standards for universal engineering policy), matching dioptron and zetesis rather than inventing a third shape. The workflow gains permissions: contents: read and a concurrency group — the reusable it calls declares the former for its own job but no concurrency group at all, so without the caller's group a rapid re-push left the superseded run to run to completion.

Verification — the gate was watched going red

A gate that has only ever been green is not evidence. Run on this box with a branch-built kanon 0.1.12:

1. Clean tree — kanon gate --tier full --force .:

PASS  repo-lint
PASS  readme-lint

2. Preamble stripped from CLAUDE.md, nothing else changed — the same command:

CLAUDE.md:1 [CONTEXT/preamble-required] context file missing preamble with scope, defers_to, and tightens
FAIL  repo-lint
PASS  readme-lint
GATE FAILED  1 step(s) failed: repo-lint

Against the previous pipeline that same tree passed. That difference is the fix.

3. Restored — kanon lint . --summary: No violations found.

Not fixed here, deliberately

The emitted trailer still reads +stages:fmt,check,clippy,nextest,lint — stage names from config rather than the stages that actually ran, in a repo with no Cargo workspace for four of the five to mean anything. That is a kanon substrate defect (forkwright/kanon#2555), not something this repo can correct, and #1's finding already names it.

The scaffold-side half of #1's desired correction — deriving this pipeline from one fleet scaffold with a fitness fixture — also lives in kanon. This PR fixes the instance; the generator that produced two identical copies of the defect is a kanon change and is called out on the issue.