queue: queue add by jason or sage requires --gate-owner (#1595)

Row 101. Built by a Haiku subagent under Researcher (decision 129),
packet agents/researcher/work/queue-101/r1/, candidate manifest
ee1335a6e44610f676ade116733d180ac6f0b3603a58306110cbd1dd1e9c1f69.
Filbert approved on #1595, comment 28245.

The check runs at write time in store.mjs mutateAs, with no SEMANTICS
bump, so the live Console keeps reading the log.

Sage's gate rerun on 79e126be0 with rows 101 and 105 applied, Docker
up: node suites bus 128, business 67, cli 146, control-board 124,
conversation 182, discord 178, harness 70, ledger 78, mosaic 69,
queue 155, runs 43, seat 109, tasks 92, webui 108; scripts auth 15,
conductor 17, config 24, discord 66, extension-package 18,
foundation 44, queue 28, release 14, task 98. All pass, 0 fail.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/queue/README.md

@@ -59,6 +59,14 @@ create that shape, since a row can't collect its own owner's required
 approval. Replay doesn't check it, so a log written before the rule still
 loads.
 
+`add` takes `--gate-owner SEAT`. The privileged actors, `jason` and `sage`,
+must pass it: the write path refuses a privileged add with no gate owner, and its
+message names the flag, before anything is written. There is no default for
+them, since a Jason gate nobody meant is a step in front of Jason that he
+never agreed to. A non-privileged add can't set a gate owner, and its row gets
+`jason`. The check is in the write path, not replay, so existing log entries
+replay unchanged and the log format is unchanged.
+
 Exit codes: 0 ok; 1 the operation failed; 2 invalid data or refused;
 3 uncertain (visible or durable, not acknowledged; for a review request,
 not known to be posted); 4 usage.