fix(docs,ci): two baseline entries were misclassified, and eight gates had no local hook

[DuqueOM]

First of three PRs closing the residue from #84.

Two of my five "unimplemented" entries were misreadings

scripts/smoke_test.py was never missing. The release-checklist skill says, in so many words:

the template does not ship a scripts/smoke_test.py script (would compete with deploy-common.yml as SSOT)

It is a deliberate, documented non-existence. The path gate flagged it only because the sentence wrapped the path in a code span, and my baseline then recorded a correct design decision as a defect. Rewritten as plain prose, per the convention docs/governance/doc-path-references.md already states: a code span asserts this resolves, so a path you are talking about is not one.

scripts/load_test_services.py was a wrong path, not a missing file. The artefact exists:

Referenced	Reality
locust -f scripts/load_test_services.py (×3 in the load-test workflow)	templates/service/tests/load_test.py, run by make load-test as locust -f tests/load_test.py

An agent following that workflow fails on every one of the three commands. Corrected to tests/load_test.py — the form that is right from inside a generated service, which is where the workflow runs.

Baseline: 7 entries → 5.

A broken link that was suppressed, not unnoticed

templates/service/docs/ADOPTION.md linked [SECURITY.md](../SECURITY.md). That resolves to templates/service/SECURITY.md here, and to the service root in a generated service. Neither exists.

I previously reported this as "the Link Check does not flag it". That was wrong, and the truth is worse — .github/markdown-link-check.json carried a dedicated suppression for that exact link:

{ "pattern": "^\\.\\./SECURITY\\.md$" }

Someone saw it and silenced it. The sentence is about this template's disclosure SLA, so the link now points at the upstream SECURITY.md absolutely, and the suppression is deleted. The repo-root copy of the same document resolves correctly and is untouched.

The systemic half: eight gates with no local hook

Eight jobs in validate-templates.yml had no pre-commit hook at all:

doc-coherence · cicd-template-drift · vendored-runtime-drift · common-utils-drift · dashboard-inventory · baselines-expiry · test-clock-isolation · agentic-adapter-sync

So there was no way to run the full gate set locally, and the only feedback loop was push-and-read-CI. That is exactly how three separate breakages reached the remote on #84.

All eight are now pre-commit hooks, path-filtered so each fires only on the files it guards.

This is deliberately not a revival of the pre-push stage retired in R5-L4. That decision was about a 60-second scaffold hook training --no-verify on contributors, and it cites an industry budget of pre-commit < 5 s. All thirteen gates together run in 0.9 s, so the reasoning does not transfer. The justification is written next to the original decision in .pre-commit-config.yaml so the two are read together rather than looking like a silent reversal.

make verify runs the same thirteen in one command for the sweep-before-PR case, reporting every failure rather than stopping at the first — a contributor who broke three things should learn that in one run. Slow end-to-end stays in make smoke.

$ make verify
  check_doc_coherence                PASS
  check_doc_path_refs                PASS
  check_cicd_template_drift          PASS
  check_vendored_runtime_drift       PASS
  ... 9 more ...
✓ every gate green — safe to push

Verified negatively

Test	Result
Introduce a dead path, run make verify	✅ exit 1, check_doc_path_refs FAIL, names the path
Break a vendored runbook's byte-identity, git add, run the hook	✅ blocked at commit time — the exact mistake that reached CI on #84
Clean tree	✅ all thirteen PASS

🤖 Generated with Claude Code