gate: CI-hosted run with CI-blessed baselines

[softmarshmallow]

The v2 engine's merge gate (cargo run --release -p n0 --bin gate) verifies four shot goldens byte-identically, replay determinism, the oracle-law differential, and bench budgets (crates/n0/rig/baselines.json). It is deliberately not wired into CI at the landing of #5, because both baselines are machine-local:

• The shot goldens encode one machine's rendering stack. At landing they had to be re-blessed with etiology: an OS-level environment drift produced ±1-LSB antialiasing changes on <50 of 4.9M pixels while the promoted build was proven byte-identical to the pre-promotion build (A/B in model-v2: anchor — land the v2 engine as the crates/n0 family #5).
• The bench budgets are context-sensitive: the same A/B measured both builds uniformly ~1.7–2.5× over the recorded baselines in an agent-harness shell (the old build slower than the new — environmental, not regression).

Wanted: a CI job that runs the gate against CI-blessed baselines — goldens recorded on the CI image (re-blessed when the image updates, with etiology), and budgets either baselined on CI hardware with generous variance bounds or reduced to a regression-ratio check between two in-job runs. Until then the gate remains the local pre-merge bar for crates/n0 changes.

Refs: #5 (landing evidence), #9 (v2 tracking).