feat(pm): teach the merge-queue guard the governed surface's references tier

The maintainer tiered the governed surface on 2026-09-13 and the charter text
landed with PR #18018, but the queue guard still demanded an authorized
approval for every governed path — so the tier was declared and not enforced.

The merge-group leg now classifies each governed pull request's governed paths
and, when they ALL lie under `.claude/skills/pm-dispatch/references/`, accepts
the skills seat's review of record on the CURRENT head in place of the
approval: a `## Contract review` comment on the PR thread carrying a
`Reviewed-by:` line and a `Served-tier:` reading that stands. Every other
governed path is the rules layer and keeps today's predicate byte-for-byte —
16 predicate bodies are md5-identical to their pre-change selves.

Recognition is IMPORTED, never re-implemented: the heading marker, the head-sha
span test, the newest-of resolution, the `Reviewed-by:` key line and the
`Served-tier:` reader all come from the two files that own them. Reaching them
needed the module-eval cycle solved rather than worked around, so the import is
lazy and this file's dispatch no longer carries a top-level await; the battery
pins that precondition against this file's own source.

The leg is MONOTONE by construction — consulted only for an entry no authorized
approval satisfied — so it can lift a refusal and can never create one.

Claude-Session: https://claude.ai/code/session_01DAcomhvR9kKizeYgg89Vo8
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

scripts/pm/check-clause2-carriers.mjs

@@ -2441,7 +2441,7 @@ export function needsRecordRead(pair) {
 }
 
 /** The `Reviewed-by:` key line, exactly as C4 reads it -- one spelling, not two. */
-const REVIEWED_BY_LINE = AUTHORSHIP_KEY_LINES.get('Reviewed-by');
+export const REVIEWED_BY_LINE = AUTHORSHIP_KEY_LINES.get('Reviewed-by');
 
 /**
  * The `Served-tier:` key line -- the THIRD provenance fact a verdict declares