Derive a gate for the surface the program it RUNS reads (#14012)

scripts/pm/dispatch-gates.mjs already follows a gate to a module it IMPORTS
and appends that module's declared population to the gate's own. It never
followed the other edge by which a gate reaches a program in this repo:
spawning it. check:pm-dispatch-gates runs the tool itself, and running it
readdirs .github/workflows -- so a workflows-only diff derived 18 families,
none of them the one gate whose subject is the file being added.

The follow now traverses the exec edge through the same three pieces as the
import edge: declaredInheritedPopulation narrows what a follower inherits,
hintOrigin labels it, and a target that is itself a gate file is refused.
resolvePathExpression gains one hop so a join component spelled as a named
constant resolves, which is the idiom a gate uses to name the program it runs.

Measured over 196 families x 7673 tracked files: +32 covered pairs, 0 lost,
0 re-attributed, exactly one verdict moved. Self-test 1073 -> 1090 cases.


Claude-Session: https://claude.ai/code/session_01Pk26oZ12t5N1hwGW1m1MgC

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]