docs(decisions): record the measured gate rc, stage list and touched subset

The handoff asserted a gate outcome before the gate had been run against a
committed branch. Replaces it with what was actually measured on 9a4489b:
rc 3 (UNDETERMINED) -- green decisions-log/lint/l0/render-golden/l1/approval-policy,
skipped spec-immutability/gitea-settings/conformance -- plus the twelve touched
requirements that are UNVERIFIED at L2/L3, and a note that approval-policy passed
VACUOUSLY here (event='none') while the PR itself needs a non-author review because
conformance/** is a sensitive path.

Also records that the three conformance/tests/l1-rendering goldens are regenerated:
they are expected-output fixtures of the same renderer, and the L1 stage caught their
drift on the first gate run rather than anyone remembering them.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

decisions/2026-09-30-oauth2-proxy-cookie-collision-fleet.md

@@ -31,7 +31,9 @@ differ, so a future refactor to a constant fails in the renderer's own test.
 
 Re-rendering with the canonical command regenerated **five** goldens, not four. Jackett is the
 fifth, and this is the one thing in this branch the PM brief did not anticipate — see
-"the jackett collision" below.
+"the jackett collision" below. The three `conformance/tests/l1-rendering/*/golden/` fixtures are
+expected-output copies of the same renderer, so they are regenerated too; that is not collateral
+damage, it is the L1 stage doing its job (it FAILED on the first gate run and named the drift).
 
 **The new gate check** is `conformance/tests/l0-static/oauth2-proxy-cookie-names-distinct/`,
 declaring `conformance.home.k3s/scope: whole-repo` so `ci/l0.sh`'s `--include-scope` union runs it
@@ -151,10 +153,17 @@ on its own terms and should be closed rather than rebased.
 ## What I did NOT verify
 
 - **Gate rc 3 (UNDETERMINED), not 0.** Green stages: `decisions-log`, `lint`, `l0`, `render-golden`,
-  `l1`, `approval-policy`. **Skipped:** `spec-immutability` (the sibling spec repo is not mounted —
+  `l1`, `approval-policy`. **Skipped:** `spec-immutability` (the sibling spec repo is not mounted
-  the one tolerated skip), `gitea-settings` (no `SETTINGS_API_TOKEN`), and **L2/L3 conformance**
+  at the container's `SPEC_REPO` path from a worktree — the one tolerated skip), `gitea-settings`
-  (`CLUSTER_AVAILABLE` unset). Nothing FAILED; nothing runtime was certified either. **rc 3 is
+  (no `SETTINGS_API_TOKEN`), and **L2/L3 conformance** (`CLUSTER_AVAILABLE` unset). Nothing FAILED;
-  UNDETERMINED, never green**, and this branch must not be described as green on the strength of it.
+  nothing runtime was certified either. **rc 3 is UNDETERMINED, never green**, and this branch must
+  not be described as green on the strength of it. The touched-requirement subset —
+  `R-GITOPS-02 R-IDP-02 R-IDP-06 R-NET-01 R-NET-05 R-NET-06 R-NET-07 R-PLAT-02 R-TEST-01 R-TEST-02
+  R-TEST-03 R-TEST-04` — is reported **UNVERIFIED** at L2/L3 for all twelve.
+- **`approval-policy` passed vacuously here** (`event='none'` — it is not a pull_request run). On
+  the PR it will REQUIRE a non-author approving review: `infra/gitea/approval-policy.json` lists
+  `conformance/**` as sensitive, because changing the tests changes what green MEANS. That is
+  correct and expected for this branch, not an obstacle to route around.
 - **No browser round-trip. The sign-in fix is UNVERIFIED end-to-end.** Identical to the gap the
   2026-09-29 entry recorded and did not close: the collision has still **never been reproduced in a
   browser**, because reproducing it needs two gated apps visited in one session. Everything here is