[AIR #943] codev doctor/update: warn on PR-producing protocol overrides missing a pr gate

[waleedkadous]

Closes #943.

Summary

Post-#927 guardrail. #927 made Needs Attention surface PRs via the universal pr gate: porch requests the pr gate when a protocol's PR-creating phase completes, and derivePrReady surfaces the PR from that pending gate. A PR-producing protocol whose resolved definition (a tier-1/2 local override) carries no pr gate is therefore never requested, and its PRs silently vanish from Needs Attention. Because codev update deliberately preserves user-modified files as local overrides, it neither fixes nor flags such an override — the breakage is silent (an adopter's gateless bugfix override caused exactly this).

This adds a check that resolves each bundled PR-producing protocol through the 4-tier resolver and warns loudly — with the fix — when one lacks a pr gate, surfaced in both codev doctor and codev update.

What changed

• packages/codev/src/lib/pr-gate-audit.ts (new) — auditPrGates(root) resolves each protocol in PR_PRODUCING_PROTOCOLS (bugfix, air, spir, aspir, pir) via resolveCodevFile (tier-1/2 override wins) and flags any whose resolved JSON has no phase gated pr (handles both the string "gate": "pr" and object "gate": { "name": "pr" } forms, mirroring porch's normalizePhase). formatPrGateWarning(w) builds the shared, loud message. experiment/maintain are excluded — not PR-producing.
• doctor.ts — new "Protocol PR Gates" section. Clean repos show ✓ All PR-producing protocols are pr-gated; offenders get a ⚠ line and appear in the summary. Non-fatal — exit code unchanged (warnings never set exit 1).
• update.ts — prints the same warnings after the update summary and exposes them on UpdateResult.prGateWarnings. Does not auto-modify the override (consistent with update's preserve-customizations behavior) — warn + instruct only.

Example output

Against a bugfix override whose PR phase lost its gate:

⚠ Protocol `bugfix` (local override at `codev/protocols/bugfix/protocol.json`) has no `pr` gate on its PR-creating phase. Its PRs will not surface in Needs Attention (Codev ≥ 3.1.5). Add `"gate": "pr"` to that phase, or remove the override to use the stock pr-gated protocol.

Key decisions

• Bundled set, not dynamic discovery. The PR-producing set is hardcoded to the five bundled protocols (as the issue prescribes), mirroring derivePrReady's documented set. A new PR-producing protocol adds itself to the constant.
• "Has a pr gate at all" is the correct check. Surfacing requires porch to request the pr gate, which it only does for a phase with gate === 'pr'. If no phase carries it, surfacing is broken — that's exactly what's flagged. (Stock skeletons always carry it, so in practice this only fires for overrides.)
• Faithful to porch's gate parsing. gateName() accepts both gate shapes so the audit stays in sync with how porch actually reads gates.

Test plan

• pr-gate-audit.test.ts (unit): flags a gateless override; passes a correctly-gated one; recognizes the object gate form; skips unparseable/absent protocols without crashing; flags multiple offenders independently; asserts the bundled set excludes experiment/maintain; verifies the message wording.
• doctor.test.ts / update.test.ts (integration): a gateless override surfaces in doctor output and in result.prGateWarnings; clean overrides produce the ✓ / empty result.
• Headline path (real built CLI): codev doctor in this repo prints ✓ All PR-producing protocols are pr-gated; against a gateless fixture it prints the warning; codev update --dry-run prints it after the summary.
• tsc --noEmit clean. Porch build + tests checks pass.

Out of scope (per issue)

Auto-fixing/migrating overrides; any change to #927's surfacing logic; experiment/maintain completion-gate surfacing.