[Task]: accept plural required-gate check maps

[ArchonVII]

Problem

The reusable repo-required-gate.yml@v1 policy-validation job hard-codes .agent/check-map.yml to the legacy singular required_gate: shape. Consumers adopting the canonical plural required_gates: list fail policy validation even when every declared check is valid. ArchonVII/repo-template PR #187 is the live reproducer.

Goal

Make the shared policy validator accept the canonical plural required-gate list while preserving compatibility with existing singular check maps and failing closed on malformed declarations.

Scope

• Update the canonical reusable required-gate workflow validation.
• Add regression coverage for plural, legacy singular, and malformed check-map shapes.
• Record the operational change and release propagation requirement.

Non-Goals

• Changing consumer branch-protection settings.
• Moving the owner-gated v1 tag in this implementation lane.
• Changing repo-template's canonical plural schema.

Acceptance Criteria

• A versioned check map with required_gates: and one or more check_name entries passes policy validation.
• A versioned legacy check map with singular required_gate: remains compatible.
• Missing version, missing required-gate declaration, empty plural lists, and declarations without a non-empty check_name fail closed.
• Validation does not require every check name to equal repo-required-gate / decision; custom additional required checks are accepted.
• Automated tests exercise plural, singular, and malformed fixtures and pass with the full test suite.
• Workflow syntax validation passes.
• docs/repo-update-log.md records the change and pending propagation through the owner-gated v1 tag.

Dependencies / Blockers

Implementation is unblocked. Consumer proof remains blocked until this PR is merged and the owner-gated v1 tag is advanced.

Status

ready

Execution Gate

allowed