feat(checks): the design method installs, and the gates say whether it is here

[Tradebaas]

What changed and why

Spec 011 is signed by the owner (2026-08-05) and set to building. This is ticket 01, its tracer:
the narrow path from "impeccable is the methodology for making design" to "every gate still
holds", run on this repo, which has a frontend of its own, rather than on a fixture.

node checks/design-method.mjs --install is the route. It reads impeccable's Node floor out of
the package that states it, refuses before writing anything when the floor is not met, installs
the Claude build, and then repairs decision 0002: upstream deliberately deletes a .claude/skills
symlink pointing at another provider's skills directory, so the route moves the payload to
.agents/skills/impeccable and relinks. Rerunning it is a no-op.

The payload is gitignored like a dependency, so a clone starts without it and the files cannot
tell you it is missing. enforcement.mjs therefore reports a fourth signal beside hooks, CI and
adapter hooks, in both states, and the board shows it in both languages.

What the gates measure became a declaration instead of an accident. checks/config.json holds one
thirdParty list, each entry a path and its reason; the gates that judge this project's own
writing skip those paths, and every other gate, the secret scan included, still reads every line.
config-invariants bounds the list the same way it bounds the exclusion lists next to it.

Two of this repo's own gates shaped the diff: code-file-cap refused to let check.mjs pass its
500-line cap, so config-invariants moved into checks/check-config.mjs with its own suite (the
registry still holds 22 gates: one moved, none multiplied), and that move exposed that
code-file-cap read the exclusion list itself rather than the runner's one reader.

Two documentation corrections ride along, both because the code is the fact: the spec's Node floor
said 22.18 where the package says 22.12, and criterion 3 named a narrower set of exempt gates than
the change actually needs.

Verified by

• The install run for real, twice, on this repo: first run installs and repairs the symlink,
  second run refreshes through the symlink and leaves it standing. ls -la .claude/ confirms the
  link; node checks/design-method.mjs reports impeccable 4.0.4.
• node checks/check.mjs: OK with the payload installed, and the enforcement line reads
  "hooks armed, CI armed, adapter hooks armed, design method armed". Before the declaration the
  same run produced 818 findings across five gates, which is what the declaration is for.
• All ten suites green: 182 self-tests across five gate suites (70 runner, 35 code, 24 config, 48
  trace, 5 stack), plus progress, links, cockpit-path, cockpit and drill.
  node checks/drill.mjs --require-walk PASSED.
• The gates card rendered in both languages, showing "4 of the 4 gates on this machine are armed"
  and the new row.
• git check-ignore on six paths: the payload is ignored, and .impeccable/config.json,
  design.json and critique/ stay tracked as impeccable's README requires.
• Measured rather than assumed: the 40 markdown files impeccable ships hold zero broken asserted
  links today, so leaving them out of the document map is precaution and readability (97 documents
  instead of 137), not a repair. Stated as such in the ticket.
• Not verified here: the failure path with npm unreachable was reasoned about, not forced. Spec
  criterion 2 exercises it for real during verify of the whole spec.