build: the gate is scripts/check.sh, and CI goes

The Gitea Actions gate repeated, after the merge, what a release already runs
before it, and its runner shared the git host's container: one run there
starved Gitea of memory until it stopped answering. The lanes now live in
scripts/check.sh, run the same by the release dispatcher and by hand, and the
gate-contract test holds its lines (the ruff and pip-audit checks read it
instead of the workflow). The two audits only CI ran join the gate: pip-audit
over the lock (pinned in the test image, blocking at any severity) and npm
audit of the production dependencies. The engine contracts drop the CI
containers; the register records that pushes have no server-side gate.

frontend/src/lib/nodeEngine.contract.test.ts

@@ -48,18 +48,6 @@ it("builds the shipped bundle on the pinned engine", () => {
   ).toBe(pinned);
 });
 
-it("runs the server gate on the pinned engine", () => {
-  // The frontend job only — the backend job's node runs the checkout action, never our code, so it is
-  // deliberately not part of this contract (see the note in check.yml).
-  expect(
-    majorIn(
-      readRoot(".gitea/workflows/check.yml"),
-      /^\s*container: node:(\d+)-bookworm$/m,
-      "check.yml",
-    ),
-  ).toBe(pinned);
-});
-
 it("declares the pinned engine to npm and to tsc", () => {
   expect(pkg.engines?.node).toBe(`${pinned}.x`);
   // Types a major ahead of the runtime make tsc green over APIs the shipped engine does not have —