fix(land-and-deploy): never merge over red, pending or missing CI (#2995)

/land-and-deploy gated only on required checks, so a repo with none
(every GitHub Free private repo, any repo without branch protection)
skipped the CI wait and could merge over red CI. The verdict now comes
from bin/gstack-ci-gate, a tested helper bound to the head SHA: all
checks by default, cancel/unknown buckets fail, NO_CHECKS needs explicit
per-head approval, and both merge commands (including --auto) run only
after a PASS for the same SHA they pin with --match-head-commit.

Co-authored-by: harshitgavita-07 <harshit.gavita@gmail.com>

scripts/question-registry.ts

@@ -467,6 +467,22 @@ export const QUESTIONS = {
     signal_key: 'decision-autonomy',
     description: "Canary detected regressions — roll back the deploy?",
   },
+  'land-and-deploy-ci-override': {
+    id: 'land-and-deploy-ci-override',
+    skill: 'land-and-deploy',
+    category: 'approval',
+    door_type: 'one-way',
+    options: ['accept', 'reject'],
+    description: "Merge this head while these named non-required CI checks are red or pending?",
+  },
+  'land-and-deploy-no-ci-confirm': {
+    id: 'land-and-deploy-no-ci-confirm',
+    skill: 'land-and-deploy',
+    category: 'approval',
+    door_type: 'one-way',
+    options: ['accept', 'reject'],
+    description: "No CI ran on this head — merge it anyway?",
+  },
 
   // -----------------------------------------------------------------------
   // /cso — security audit