chore(deps): hydra-gates 1.10, so the E2E skip-discipline gate can run

[rubenvdlinde]

Why

conduction/hydra-gates v1.10.0 contains check_e2e_skips.py, which the shared quality workflow needs to run the E2E skip-discipline check. On v1.9.0 that script does not exist, so the step reports

::warning::check_e2e_skips.py not found (hydra-gates not vendored here yet)
— skip discipline NOT measured on this run.

and the job goes green having measured nothing. Today that is the state of 20 of 21 fleet apps — only launchpad, which was bumped in ConductionNL/launchpad#359, produces a verdict at all.

A skip is counted as a pass, and the Playwright report is the only place a runtime test.skip(cond, reason) records its reason — the CI log prints counts without reasons. So until this lands, an app cannot tell a legitimate skip from a fixture that silently never ran. Context in ConductionNL/.github#609.

Lock-only

composer.json already allows this — the constraint is ^1.8.2 and 1.10.0 satisfies it. Only composer.lock moves.

Blast radius, measured before opening this

v1.10.0 adds six gate scripts over v1.9.0:

check_adr_number_collision   check_manifest_copy_style   check_retired_git_host
check_e2e_skips              check_repair_registration   check_system_elevation

So this is not a no-op bump, and it is deliberately opened as a PR rather than pushed: the gates run here and report before anything can redden development.

gate-99 manifest-l10n-coverage was run locally against every fleet app first, because that is the gate that caught launchpad when it was bumped. 18 of 20 are clean; this app is one of them. The exception is zaakafhandelapp (59 manifest strings with no nl.json key), which needs its l10n gap closed before it can take this bump.

[rubenvdlinde]

Merging over the red Hydra Gates, same reason as #1413 and with the same evidence.

[gate-22] manifest-validation: FAIL — 15 schema violation(s)
[gate-53] effective-manifest-crossref: FAIL — 15 structural violation(s)

Byte-identical counts to the failure already present on development, and this PR changes exactly one file — composer.lock — which cannot affect manifest validation.

The 15 violations are real and remain open as pre-existing debt. Note for whoever picks them up: running check_manifest.js bare against this tree passes ({"status":"passed","checked":1,"failed":0}), so reproducing them needs the assembled manifest (base + fragments + menu-layout) that gate-53 names, not src/manifest.json alone.

[github-actions]

Quality Report — ConductionNL/dossiq @ dfe0206

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue3-compile		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 106/106
npm			✅	✅ 552/552
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					⏭️
Playwright					✅
Hydra gates					❌

---

Quality workflow — 2026-08-28 08:07 UTC

Download the full PDF report from the workflow artifacts.