rescue(ms-gate-001): preserve uncommitted gatekeeper WIP found in canonical clone (Q19 O1, Jason 2026-08-25)

Gatekeeper module (Gitea PR-webhook -> pending merges), AddPendingMerges
migration, vitest-runner, webhook edits, compose/CI/env/docs touches.
Applied to the tree in a single event 2026-08-23 18:45, author unknown.
Base main@32896770 (2026-03-09). Rescued verbatim for remediation per
board row; no functional review implied.

.woodpecker/ci.yml

@@ -280,7 +280,7 @@ steps:
         from_secret: woodpecker_webhook_secret
     commands:
       - |
-        BODY="{\"branch\":\"${CI_COMMIT_BRANCH}\",\"status\":\"${CI_PIPELINE_STATUS}\",\"buildUrl\":\"${CI_PIPELINE_LINK}\",\"repo\":\"${CI_REPO}\"}"
+        BODY="{\"branch\":\"${CI_COMMIT_BRANCH}\",\"status\":\"${CI_PIPELINE_STATUS}\",\"buildUrl\":\"${CI_PIPELINE_LINK}\",\"repo\":\"${CI_REPO}\",\"prNumber\":${CI_COMMIT_PULL_REQUEST:-null},\"headSha\":\"${CI_COMMIT_SHA}\"}"
         SIG=$(echo -n "$BODY" | openssl dgst -sha256 -hmac "$WOODPECKER_WEBHOOK_SECRET" | awk '{print $2}')
         curl -s -o /dev/null -w "%{http_code}" -X POST "${MOSAIC_WEBHOOK_URL}/api/webhooks/woodpecker" \
           -H "Content-Type: application/json" \