fix(ci): call spec-immutability.sh directly in gate (make masks exit 3 as 2)

`make -C ci spec-immutability || [ $? -eq 3 ]` fails on the honest skip: GNU make
exits 2 when the recipe exits 3, so the guard never matches. Invoke the script
directly so the exit-3 skip (spec repo not checked out in CI) is tolerated while a
real spec drift (exit 1) still blocks.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

.gitea/workflows/gate.yml

@@ -50,8 +50,12 @@ jobs:
       # CI here (it is a separate repo; SPEC_REPO_SLUG is not wired into this runner), so
       # the guard honestly SKIPS (exit 3) rather than faking green. A real drift/edit of a
       # co-located spec would exit 1 and fail. Tolerated: exit 3 only.
+      # Call the script DIRECTLY, not via `make`: GNU make masks a recipe's exit code as
+      # its own 2 on failure, so `make spec-immutability || [ $? -eq 3 ]` would see 2 and
+      # fail. The script itself exits 3 on an honest skip (spec repo not checked out here),
+      # which we tolerate; a real drift/edit exits 1 and fails the gate.
       - name: Spec immutability (R-TEST-06, skips if spec repo absent)
-        run: make -C ci spec-immutability || [ "$?" -eq 3 ]
+        run: ./ci/spec-immutability.sh || [ "$?" -eq 3 ]
 
       - name: Static gate — lint + Kyverno L0 + L1 render
         run: make -C ci lint l0 l1