fix: pre-landing review fixes (round 2)

record-ci records the base policy that mapped the lane; the CI-first remote
gate hint respects --no-ci-carry and reruns the whole pregate; changelog and
docs say what the tool does. GSTA-258 piece A.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

test/pregate-carry-gate.test.ts

@@ -88,7 +88,11 @@ describe.skipIf(process.platform === 'win32')('CI carry clears the remote gate o
     const file = await runPregate(loaded.ctx, { stage: 'tests' });
     expect(gate(file)?.receipt).toBeNull();
     const detail = file.checks.find(c => c.id === 'lanes')?.detail ?? '';
-    expect(detail).toContain(`a verified CI run at this tree clears it: push, then gstack-ci-carry wait --base main and rerun --stage tests`);
+    expect(detail).toContain(`a verified CI run at this tree clears it: push, then gstack-ci-carry wait --base main and rerun gstack-pregate --allow-repo-commands`);
     expect(detail.indexOf('gstack-ci-carry wait')).toBeLessThan(detail.indexOf('opt in to the VM: gstack-pregate --remote --spend-cap <usd> --allow-repo-commands'));
+    loaded.ctx.ciCarry = false;
+    const off = (await runPregate(loaded.ctx, { stage: 'tests' })).checks.find(c => c.id === 'lanes')?.detail ?? '';
+    expect(off).not.toContain('gstack-ci-carry wait');
+    expect(off).toContain('run it, then gstack-pregate clear --remote pregate.json/remote_gate');
   }, 120_000);
 });

test/ship-ci-carry.test.ts

@@ -7,6 +7,7 @@ import { afterEach, describe, expect, setDefaultTimeout, test } from 'bun:test';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { fakeGhScript, type FakeWorld } from './helpers/fake-gh-runs';
+import { findFilesBySuffix } from './helpers/scratch-repo';
 import { lineOf, PREFLIGHT, RELEASE, shipFixture, type ShipFx } from './helpers/ship-bin-fixture';
 
 setDefaultTimeout(120_000);
@@ -102,7 +103,9 @@ describe('Step 5 lanes: CI carry and the tree cache', () => {
     expect(ev(['check', '--label', 'free', '--expect-cmd', FREE]).stdout).not.toContain('EVIDENCE: FRESH');
     expect(JSON.parse(ev(['carried', '--json']).stdout)).toEqual([]);
     const ok = ev(['record-ci', '--label', 'free', '--base', 'main', '--', FREE]);
-    expect([ok.status, ok.stderr]).toEqual([0, expect.stringContaining('tests_ran=12 log=- source=ci runs=7/1')]);
+    expect([ok.status, ok.stderr]).toEqual([0, expect.stringContaining('tests_ran=12 log=- source=ci runs=7/1 policy=origin/main@')]);
+    const row = JSON.parse(fs.readFileSync(findFilesBySuffix(path.join(f.state, 'projects'), '-evidence.jsonl')[0]!, 'utf8').trim().split('\n').at(-1)!);
+    expect(row.policy).toMatch(/^origin\/main@[0-9a-f]{12}:\.gstack\/pregate\.json$/);
   });
 });