fix(apps): reconcile goldens to one canonical render + enforce render==golden gate

The committed apps/ goldens were a MIX of two render flag sets: 8 services
were rendered with `--no-image-automation` (no image CRs) while gitea and
nextcloud carried stale ImageRepository/ImagePolicy CRs from a render WITHOUT
the flag. Neither single command reproduced all goldens, and the gate did not
catch it.

Part A — canonical render:
  python3 catalog/render.py --all catalog -o apps --wave-layout --no-image-automation
`--no-image-automation` is canonical: image automation is authored-but-DISABLED
(DECISIONS-LOG; image-reflector/-automation controllers not installed), and
every app was onboarded via this flag. Re-render drops the ImageRepository +
ImagePolicy objects from gitea + nextcloud only (52 line deletions, purely the
trailing image-automation blocks). No functional content changed — the
nextcloud postStart hardening and gitea OIDC hook are untouched.

Part B — enforcement:
  ci/render-golden.sh renders every onboarded catalog service with the canonical
  command into a temp dir and FAILS on ANY diff vs committed apps/ (missing
  golden or content drift), across all 10 services (not just the 3 L1 spot-checks).
  Not-onboarded catalog entries (keycloak, vm-demo) are excluded per DESIGN-waves.
  Wired as a required no-cluster stage in ci/gate.sh, ci/Makefile, and both the
  live (.gitea/workflows/gate.yml) and dormant (merge-gate.yaml) pipelines.

Proof: tampering a golden makes the stage exit 1 (blocks merge); reverting
restores exit 0. `make -C ci gate` green in the devcontainer.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

ci/gate.sh

@@ -38,10 +38,11 @@ summary "## Merge gate (R-TEST-03)"
 summary ""
 
 run_stage spec-immutability "${CI_DIR}/spec-immutability.sh"
-run_stage lint        "${CI_DIR}/lint.sh"
-run_stage l0          "${CI_DIR}/l0.sh"
-run_stage l1          "${CI_DIR}/l1.sh"
-run_stage conformance "${CI_DIR}/conformance.sh"
+run_stage lint          "${CI_DIR}/lint.sh"
+run_stage l0            "${CI_DIR}/l0.sh"
+run_stage render-golden "${CI_DIR}/render-golden.sh"
+run_stage l1            "${CI_DIR}/l1.sh"
+run_stage conformance   "${CI_DIR}/conformance.sh"
 
 echo >&2
 log "==== gate decision ===="
@@ -56,8 +57,10 @@ case "${OUTCOME[spec-immutability]}" in
 esac
 
 # L0/L1 stages: any failure blocks. A SKIP here means a seam is unwired — in
-# Phase 0 that is tolerated (placeholders), but surfaced.
-for s in lint l0 l1; do
+# Phase 0 that is tolerated (placeholders), but surfaced. render-golden is a
+# no-cluster reproducibility gate (canonical render == committed apps/ goldens):
+# a FAIL means a golden drifted from its ServiceDefinition source — always blocks.
+for s in lint l0 render-golden l1; do
   case "${OUTCOME[$s]}" in
     fail) err  "${s}: FAILED -> blocks merge"; BLOCK=1 ;;
     skip) warn "${s}: skipped (unwired seam / missing tool) — not green" ;;