deterministic-gate 1

Deterministic write gate for DeepSeek Harness: scope policy + residue scan on every file the agent writes, live in the session — the CI gate moved to the moment of the write