fix(governance): the rule gate stops being optional

Both hooks skipped `orly gate work` with a warning when the command was
missing, so the contributor least likely to have the rules is the one who
committed ungated. gitleaks in the same file already exits 1 when absent;
orly now matches it.

Hooks alone cannot close this. `core.hooksPath` is local git config and a
clone never carries it, so a contributor who never armed the hooks pushed
past both. .github/workflows/governance.yml re-runs the gate where it
cannot be skipped, pinned to the version .oracle/orly.json records so CI
proves this repository's installed ruleset rather than whatever is latest.

sweep.ts counted failed purges and still exited zero, reporting an
incomplete purge as success to anything reading the status.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>