ci: wire the merge-orchestration CVE/bump gate (bridge-gate.yml) (#127)

**Replicates the merge-orchestration CVE/bump gate** into panic-attack's
own CI (pilot landed in reposystem#114; design in hypatia#459). **Meta
change — it edits CI — so it's for your review, not auto-merged.**

This repo *is* the Patch-Bridge, so the gate builds it **from source
here** and self-triages its own dependency tree (fine).
`.github/workflows/bridge-gate.yml` runs on `dependabot`/`renovate` bump
PRs: **B3** (nix → fail) + **B1** (reachable unmitigable CVE → fail). A
clean patch/minor CVE-clear bump passes. SHA-pinned `checkout`, env-only
context, `timeout-minutes`. Verdict logic was tested in hypatia#459.

After merge (your call): add `bridge-gate` to **required status checks**
to make a fail block; `@dependabot rebase` existing bump PRs to run it
on them.

---
_Generated by [Claude
Code](https://claude.ai/code/session_011GXPoh6pB6rm3jfeLHWMtc)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/bridge-gate.yml

@@ -0,0 +1,59 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#
+# bridge-gate.yml -- merge-orchestration CVE/bump gate.
+# Wired from hyperpolymath/hypatia docs/design/merge-orchestration (artifact 4, PR #459).
+#
+# Gates dependency-bump PRs on:
+#   B3  nix bump                  -> fail (Nix removed estate-wide; close, do not merge)
+#   B1  reachable unmitigable CVE -> fail (via panic-attack's OSV-backed Patch-Bridge)
+# A clean patch/minor CVE-clear bump passes. A failing gate is a red check; to actually
+# BLOCK auto-merge, add "bridge-gate" to this repo's required status checks (owner action).
+#
+# Note: this repo (panic-attack) is the Patch-Bridge itself -- the gate builds and runs
+# it against its own dependency tree, which is fine (self-triage).
+#
+# Review notes:
+#  - B2 (major -> review) is left to the existing human-review path.
+#  - Production hardening: a released binary or a hyperpolymath/standards reusable workflow.
+#  - github context via env: only (no ${{ }} in run lines) per estate rules.
+name: bridge-gate
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+permissions:
+  contents: read
+jobs:
+  bridge-gate:
+    if: ${{ startsWith(github.head_ref, 'dependabot/') || startsWith(github.head_ref, 'renovate/') }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+
+      - name: B3 gate -- nix bumps (no network)
+        env:
+          HEAD_REF: ${{ github.head_ref }}
+        run: |
+          if [[ "$HEAD_REF" == dependabot/nix/* ]]; then
+            echo "::error::B3: nix bump -- Nix removed estate-wide; close, do not merge."
+            exit 1
+          fi
+
+      - name: Build panic-attack (Patch-Bridge) from this repo
+        run: |
+          cargo build --release --features http
+          echo "$PWD/target/release" >> "$GITHUB_PATH"
+
+      - name: Bridge triage (queries OSV) -> BridgeReport
+        run: panic-attack bridge triage . --output bridge-report.json
+
+      - name: Apply B1 verdict -- reachable unmitigable CVE -> flag
+        run: |
+          blockers=$(jq '[.cves[]? | select(.classification=="Unmitigable" and .reachability.status=="Reachable")] | length' bridge-report.json)
+          if [ "$blockers" -gt 0 ]; then
+            echo "::error::B1: $blockers reachable unmitigable CVE(s) -> safety=flag (auto-merge blocked)"
+            jq -r '.cves[]? | select(.classification=="Unmitigable" and .reachability.status=="Reachable") | "  - \(.vulnerability.cve // .vulnerability.id): \(.rationale)"' bridge-report.json
+            exit 1
+          fi
+          echo "B1 PASS: no reachable unmitigable CVEs -> arm-eligible (pool-gated)."