Stop recursive gates and enforce incident cleanup

[CodingCossack]

What changed

• Requires transition end conditions to be wired to an action that can fire
• Treats apparatus that repeats an assertion or compensates for an unreliable gate as proof recursion
• Explicitly preserves focused tests of a gate's distinct decision logic
• Requires post-incident machinery to be re-justified after deployment
• Judges the total machinery pile, not only each item in isolation

Why

The previous rules allowed release gates to self-justify, allowed comments to count as expiry mechanisms, and did not force an after-incident subtraction pass.

Impact

This is an additive instruction change. Skill discovery, invocation policy, and packaging are unchanged. Rollback is a one-commit revert.

Checks

• Repository validator passed
• Official skill validator passed
• skills@1.5.23 add . --list found exactly anti-machinery
• Local Codex, Agents, and Claude mirrors are byte-identical
• Independent pressure test removed canary-specific proof recursion while retaining a focused signed-manifest gate test