docs(decisions-log): PR #19's CI has no approval-policy check -- measured, not assumed

The brief for the trigger-credential work said PR #19 would FAIL `approval-policy`
because infra/gitea/** is security-relevant. Measured on the head commit's
/statuses: `gate / gate (pull_request)` succeeded in 1m34s and the conformance
context is the usual blocked placeholder. .gitea/workflows/ holds only gate.yml
and the dormant merge-gate.yaml -- there is no path-scoped approval policy at all.

So the "security-relevant paths need a human" rule is carried entirely by
required_approvals: 1 plus a reviewer reading the diff, not by a check. Recorded
because this is the same shape as every other §2b finding: a control believed to
exist because prose said it did.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

DECISIONS-LOG.md

@@ -5190,3 +5190,20 @@ repo not checked out — the documented tolerated skip) and `gitea-settings` (`S
 is a credential this agent does not hold). Both are the expected local result and `gate.yml`
 tolerates exit 3; neither was "fixed". Run with `DEV_KUBECONFIG=/dev/null` and an `ENGINE` shim
 bind-mounting the main checkout's `.git` read-only, per `CLAUDE.md` §3.
+
+### Measured on PR #19, and it contradicts the brief: there is NO `approval-policy` check
+
+The brief for this work stated this PR's CI would FAIL `approval-policy` because `infra/gitea/**`
+is security-relevant. Measured on the PR head commit's `/statuses`:
+
+    gate / gate (pull_request)          success   Successful in 1m34s
+    gate / conformance (pull_request)   pending   Blocked by required conditions
+
+`.gitea/workflows/` on `main` contains only `gate.yml` and the dormant `merge-gate.yaml`. **No
+path-scoped approval policy exists**, so nothing machine-enforces "security-relevant paths need a
+human"; that rule rests entirely on `required_approvals: 1` plus a reviewer actually reading the
+diff. Another instance of the §2b failure mode — a control believed to exist because a brief said
+so. If the policy is intended, it is missing and needs its own change.
+
+And per this repo's own rule: the green `gate` tick is **not** evidence this script works. The
+gate never executes `infra/gitea/**`, and the L2/L3 stage skipped. The script remains UNEXECUTED.