Repository access control

A fixture-digest lockfile moves the merge gate out of CI and into commit identity

The proposal hashes fixture bytes and gives every skip an expiry, but the gate only bites if the agent's credentials cannot produce the human-labeled commit that bumps the lockfile. No incident rates come with it.