fix(pm-tooling): derive dispatch gates from CI's own path triggers (#9188)

* fix(pm-tooling): derive dispatch gates from CI's own path triggers (#9171)

dispatch-gates.mjs matched a check family only through the path literals
scanned out of the gate's own source. CI decides whether a job runs from a
different fact entirely — the workflow's `on.pull_request.paths` list — and
nothing reconciled the two.

Measured on this tree before the fix: four workflows declare a `paths:` filter
AND contribute check families, and across their declared globs there were 42
(trigger, family) pairs CI would schedule that the derivation named in neither
half of its output. The whole `Spec property liveness` job was among them — all
four of its gates read the metadata-type registry rather than a path, so they
carry no watch hint and sat in the `undetermined` bucket even for a card editing
`packages/spec/**`, the job's own first trigger. Every dispatch brief tells a
dev to derive the gate union with this script and run it, so following the
instruction exactly still under-ran.

The trigger list is READ at runtime, never mirrored: a hand-written map from
`packages/spec/**` to `check:liveness` would be a second copy of a fact the
workflow already states, which is the drift this file's contract refuses
everywhere else. Same measurement after: 0 divergences.

- extractTriggerPaths: `on.pull_request.paths` in declaration order, block and
  flow spellings, decoys outside the `on:` mapping excluded
- triggerCovers / triggerListCovers: GitHub filter-pattern semantics including
  ordered `!` negation; the directory-surface reach is decided on the pattern's
  literal prefix, which refuses the reach a leading `**` would claim
- coveringHint becomes coveringKey and returns provenance, so the `matched via`
  column distinguishes CI's declaration from this tool's inference
- the residue now sizes the families whose workflows declare no filter at all —
  CI runs those on every PR and no path derivation can narrow them

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y26DJEHSBhhAQ6wwfsHNza

* test(pm-tooling): the trigger-provenance case must report, not throw (#9171)

Indexing straight into hits[0] aborted the whole self-test run when the trigger
key regressed, so every case below it — the live spec-liveness-check.yml pins
included — stopped reporting. Read it defensively: the case fails, the run
continues, and the gate says what else it checked.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y26DJEHSBhhAQ6wwfsHNza

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-project-manager