v0.192.0

• What a push runs. The default pre-push tier no longer repeats work the hosted pull-request CI already runs and blocks the merge on. It skips the CVE-replay corpus and layer-recall locally, runs self-scan and the Haskell precision check live only when the change touches code they measure (the first hosted run of the new `bench-gates` job failed on a self-scan drift that the fast tier had skipped, which is why self-scan stays local for scripts, hooks and engine changes), and runs only the unit-test files that can see the change (reverse import graph plus named-path mentions in scripts/gate-select.mjs) instead of the whole suite. A change it cannot bound, or a selection over 60% of the suite, runs everything. --full or AGENTIC_SECURITY_PUSH_GATE=full restores the old gate. Every skipped check is printed with its reason and is never reported as passed.
• Those checks now run on the pull request. A new bench-gates job (self-scan, mutation, fix verification, layer recall, Haskell precision) runs in parallel with the test shards and is a required check, so a regression the local push no longer catches turns the pull request red instead of failing an hour into a release.
• Overlapping the waits in ship. The part of the release gate that hosted CI does not cover (chiefly the release closure, 18 of the last 22 minutes of the verify phase) now starts on the pull-request head while the hosted checks run, and a failure stops the run before the merge instead of after it. After the merge only the two checks that need it remain. Dependency currency is also checked before anything is pushed: it failed an hour into the 0.190.0 release on a newly published advisory.
• Measured, with a caveat. On the one real change tried (a one-line edit to a Haskell engine module, base set to the previous commit), the fast tier selected 390 of 1,028 test files and passed in 1,633 s, but the machine was heavily loaded by other applications, so the benches ran 1.2 to 5 times slower than in an earlier idle profile of the old gate (1,155 s, of which the full suite was 704 s). Estimated idle time for that change is under 10 minutes, not the under-5-minute target. A change to a central module still reaches about 40% of the suite through static imports. Getting a central change under 5 minutes needs per-test line coverage so a comment-only or unexercised edit selects almost nothing; that is not built.
• Not changed: the hosted release workflow still runs the whole gate with caching off before it publishes, and the tag-time trust model is unchanged.