every gate ships a case proving it fails on nothing

Two gates have reported green while checking nothing — the DCO gate counting a synthetic merge commit, the attribution gate accepting the pristine template. Both were caught by hand, which is not a mechanism. Each of the nine gates now carries a --self-test run in the same CI job as the gate, and four had real null-input holes closed in the same change: the path gate and the DCO gate passed on an empty file list inside a pull request, conservativity re-baselined itself when its shape file was missing, and the frozen check verified an empty registry. A gate that matches nothing is indistinguishable from a gate that works, and it fails in the direction that grants passes.