check-role-discipline.py's worktree cutover names an unlanded sha, so integration paths are still exempt

Row: GATE-CI-ENFORCEMENT-FLOOR

check-role-discipline.py's second cutover never activated, because the sha it
names never landed.

WORKTREE_DISCIPLINE_SINCE: str | None = "f236ca96088cce64eadc7c794a73033e2c4ec177"

f236ca960 is policy: every unit of work happens in its own worktree,
2026-08-09. It exists as an object in this repository but it is not an
ancestor of main:

$ git merge-base --is-ancestor f236ca96088cce64eadc7c794a73033e2c4ec177 origin/main
$ echo $?
1

Its landed twin is bd6b3936b, the squash of the same work carrying (#221).
The module docstring explains why the constant names a different commit --
"a commit cannot name its own SHA, so this names the commit that introduced the
behaviour" -- and the sha it captured is the pre-squash one.

What that costs

_since() returns False whenever the cutover is not an ancestor, so
worktree_enforced() is False for every commit on main.
policy_commit_violations therefore always runs with govern_integration=False
and keeps the integration-path exemption the docstring says the second cutover
removed. scripts/, .agents/, docs/, .github/, AGENTS.md and
CLAUDE.md can still reach main without a task branch and the gate stays
silent.

Measured on e1b5df1a6, which touches four paths -- .agents/specs/ltx25-dit-attn-fa2-hd128.md,
docs/USAGE.md, docs/models/ltx-2-5.md and tests/vllm/multimodal/ltx2_video_fixture.h.
The checker names only the fourth, because the first three are integration paths
and the exemption that should have been lifted is still in force.

The gate is not broken -- it enforces the first cutover correctly, which is the
feature-path rule. It is narrower than it is documented to be, and nothing
reports the difference.

Why this is not fixed in the flow that found it

Repointing the constant at bd6b3936b changes checker semantics and will
redden landed history that has never been walked under the integration rule.
AGENTS.md routes that to the normal row, spec and fresh-review path rather than
an in-flow repair, and it needs its own red-before measurement of how many
commits on main it newly names.

It also interacts with the enforcement floor: repairing the cutover would make
pre-floor commits violate a rule they have never been walked under, and the
floor would forgive them silently. That is the "forgives by RANGE, not by
violation" cost .agents/specs/ci-enforcement-floor.md already records.

Found while advancing the floor for #2743.

Start with check-role-discipline.py, especially WORKTREE_DISCIPLINE_SINCE, _since(), worktree_enforced(), and policy_commit_violations(); compare the named SHA with bd6b3936b and the ancestry of main. Read AGENTS.md and .agents/specs/ci-enforcement-floor.md before measuring which landed commits the corrected cutover would newly affect. Done means the cutover behavior, red-before impact, and integration-path enforcement are handled through the normal row, spec, and fresh-review path.