gate: extend ADR maintainer approval path predicate to .claude/skills/** — make Prime Directive #14 enforced (#9319 ruling) #9395

Implements the maintainer's #9319 decision-2 ruling (2026-08-17, 「同意」 batch): PR #9238 proved a .claude/skills/** change can reach main through the merge queue with zero human clicks, bypassing Prime Directive #14 (skill/ADR PRs are human-merge only). Prose already forbade it; only a gate makes it impossible.

The work

Extend the ADR merge-approval gate so PRs touching .claude/skills/** are held to the same contract as docs/adr/**:

• scripts/check-adr-merge-approval.mjs — widen the path predicate that decides whether a PR is gate-scoped; keep the two surfaces' reason strings distinct in output (an ADR PR and a skills PR fail with wording naming their own rule).
• .github/workflows/adr-merge-approval.yml — confirm the trigger set needs no change (it fires on all PRs and the script decides scope; verify rather than assume).
• The [governance] The ADR gate blocks the merge but not the ARMING of auto-merge — an AI seat armed it on a live docs/adr/** PR today, which would have made the maintainer's approval the merge trigger #8012 clause applies identically: an ARMED auto-merge on a gate-scoped PR keeps the check red regardless of approval (armed+approved = unattended merge, which is exactly what docs(pm): label writes re-read current labels in the same action — stale snapshots are invalid snapshots (#9226) #9238 demonstrated).
• Self-tests: extend the gate's own test coverage for the new path class, including the armed-auto-merge case and a mixed-diff PR (skills + other files ⇒ gate-scoped).

Acceptance

1. A PR touching only .claude/skills/** shows ADR maintainer approval red until maintainer approval, and stays red while auto-merge is armed.
2. A PR touching neither surface is unaffected.
3. Reverse verification in the PR body: demonstrate the gate red on a synthetic skills-path diff before approval.

⛔ This PR itself touches gate scripts — it is NOT skill-surface, but treat sequencing carefully: it must not weaken any existing check while landing. No Settings change is needed (the check is already required).

Refs: #9319 (the finding and ruling) · #9238 (the bypass instance) · #8012 (armed-auto-merge clause) · Prime Directive #14.