scenarios: expand Tier 11 governance fixture coverage

[davidahmann]

Problem

Tier 11 scenario fixtures covered baseline policy/delegation/approval/pack paths but did not include G1/G2/G3 governance paths introduced in product/PLAN_ADHOC_CONTROL.md (script controls, Wrkr fail-closed, approved-script registry fail-closed).

Changes

• Added 5 deterministic fixture scenarios under scenarios/gait/:
  • script-threshold-approval-determinism
  • script-max-steps-exceeded
  • script-mixed-risk-block
  • wrkr-missing-fail-closed-high-risk
  • approved-registry-signature-mismatch-high-risk
• Extended scenario harness assertions in internal/scenarios/scenario_test.go for script metadata and fail-closed error checks.
• Updated required fixture/wiring lists:
  • internal/scenarios/fixtures.go
  • scripts/validate_scenarios.sh
  • scripts/run_scenarios.sh (expected count 13)
• Updated scenario docs/changelog:
  • scenarios/README.md
  • scenarios/gait/README.md
  • scenarios/CHANGELOG.md

Validation

• make prepush-full
• bash scripts/run_scenarios.sh gait
• make test-scenarios
• bash scripts/test_script_intent_acceptance.sh ./gait
• ./gait doctor --json