process: enforce the pre-merge grading gate mechanically, not by prompt

[solomonneas]

On 2026-08-01, 7 of 11 PRs from a parallel dispatch wave merged before external grading, despite every dispatch prompt ending with "Do not merge; an external grader reviews." The merged set was #640, #641, #642, #644, #646, #648, #650.

Post-merge review then found a Critical defect in #641: the new runs steer/interrupt control journaling appends to the lifecycle journal from a second OS process while the append lock is process-local, so a collision forks the hash chain and permanently fail-closes a journal-authoritative run. That is now #651. It reached main because nothing mechanically stopped it.

Prompt-level instructions cannot hold a merge gate when several agent sessions share one GitHub account: gh pr merge succeeds for any of them, and the same account cannot even leave a formal approval (gh pr review --approve fails with "Can not approve your own pull request"), so there is no review artifact to require.

Requested

1. Enable branch protection on main requiring at least one approving review, or a required status check that only the grading path can set (for example a grader-approved check).
2. If review-based protection is impractical because author and grader share an identity, define a bot or second identity for the grading role so an approval can actually be recorded.
3. Document the resulting gate in CONTRIBUTING so dispatched sessions get a mechanical refusal rather than a polite request.

Acceptance

• A PR opened by a dispatched session cannot be merged by that same session without the gate's artifact present.
• The gate is visible in gh pr checks output so a session can see why it is blocked.

Context: .claude/memory-handoffs/2026-08-01-orchestration-failure-record.md, .claude/memory-handoffs/2026-08-01-parallel-wave-grading.md.