gate: harden envelope parsing and wrkr context parsing

[davidahmann]

Problem

Recent gate fixes addressed script-step context leakage and envelope parsing for Wrkr inventory / approved script registries, but null envelope fields ({"items":null} and {"entries":null}) could still be treated as empty slices and bypass fail-closed error handling.

Changes

• Ensure script-step context in policy evaluation is isolated per step so Wrkr enrichment cannot leak between steps.
• Accept valid empty envelope forms (items: [], entries: []) while rejecting malformed non-array and null envelope payloads.
• Add regression tests for:
  • Wrkr and approved-script envelope empty arrays
  • explicit null envelope fields returning parse errors
  • step-level context isolation behavior

Validation

• make prepush-full
• ./gait doctor --json
• pre-push hook: make prepush