squad MINORs from PR #4398 (gate-coverage indirection resolution)

Consolidated MINOR findings from the squad review of PR: https://github.com/spec-kitty/spec-kitty/pull/4398

The checklist below references code that does not exist on `main` until that PR merges.

- [ ] tests/architectural/_gate_coverage.py:1125 — `_composite_action_path` never normalizes or rejects `..` segments: `uses: ./.github/actions/../actions/warmup` resolves and splices, though GitHub only accepts canonical refs under `.github/actions`. The failure direction is over-attribution (the model sees more than GitHub would run — loud, not silent) and reaching it needs a review-visible workflow edit, so this is robustness, not a hole. — reject a `` containing a `..` segment (or normpath and require the result to stay under `actions_dir`).

After PR #4398 is available on main, inspect tests/architectural/_gate_coverage.py around line 1125 and the _composite_action_path entry point. Add coverage for a workflow action path containing a .. segment, then verify the path is rejected or remains within .github/actions as specified.

Written by the indexing model from the issue text.