fix(gate): accept plural required check maps

[ArchonVII]

Summary

• Replace the reusable required gate's singular-only check-map grep with a provider-owned, zero-dependency validator.
• Accept canonical plural required_gates lists and legacy singular required_gate mappings while requiring unique, non-empty string check names, including valid plain names with embedded quote characters.
• Fail closed on missing, empty, ambiguous, duplicate, incorrectly indented, non-string, or malformed required-gate declarations without hard-coding a specific check name.

Verification

• npx vitest run scripts/validate-check-map.test.mjs scripts/workflow-structure.test.mjs — 86 passed, 0 failed.

  command: npx vitest run scripts/validate-check-map.test.mjs scripts/workflow-structure.test.mjs
  location: local
  result: 86 passed, 0 failed
  timestamp: 2026-07-18T20:32:31-05:00
  

• npm test — 244 passed, 0 failed across 10 files.

  command: npm test
  location: local
  result: 244 passed, 0 failed across 10 files
  timestamp: 2026-07-18T20:32:31-05:00
  

• C:\Users\josep\go\bin\actionlint.exe .github\workflows\repo-required-gate.yml — exited 0.

• node --check on all touched .mjs files — exited 0.

• Validator CLI runs accepted both this repository's legacy singular map and repo-template PR #187's plural map.

• git diff origin/agent/codex/116-plural-required-gates..HEAD --check — exited 0.

Verification Notes

The implementation completed independent specification re-review (Spec compliant) and bounded code-quality review (Approved). The embedded-quote P1 was reproduced test-first as 4 failed / 58 passed, then repaired at the quote-state boundary; plural and legacy cases for team's / gate and 6" screen / gate now pass. Regression coverage also includes canonical multi-check plural lists, legacy singular maps, arbitrary custom names, absent optional maps, and the malformed forms named in issue #116's acceptance criteria.

Docs / Changelog

Updated .changelog/unreleased/116-plural-required-gates.md and docs/repo-update-log.md with the embedded-quote compatibility repair, verification, and pending v1 propagation.

Plan/status artifacts: issue #116 is the canonical task record and remains open until merge; no repo-facing plan or status file was created or used by this lane.

Owner decisions this lane: none.

Linked Issue

Closes #116

Risks

• Risk level: Medium — policy validation is intentionally fail-closed for the supported zero-dependency YAML subset.
• Rollback: Revert commits 197d9c9 and 8335d15 to restore the singular-only inline validation.
• Follow-ups: After merge, the owner-gated v1 tag must advance before ArchonVII/repo-template PR #187 can rerun against the repaired shared validator.