Gate: only stderr signals failure when no exit code is present

[greghughespdx]

Problem

The PostToolUse observation gate reports "fablize gate observed a tool failure" on fully successful commands. Claude Code's Bash tool often omits an exit code from the hook payload, so detect_failure/exit_success fall back to matching FAILURE_RE against the full response text (stdout + stderr). Any successful command whose stdout carries the failure vocabulary trips it: a commit message containing 'fail'/'failure', gitleaks printing 'leaks found', or grepping a doc that discusses failures. In sessions that do security or infra work (where that vocabulary is constant) the gate fires on nearly every successful command, training the operator to ignore it, which defeats the gate.

Fix

When structured exit status is present it remains authoritative (unchanged). When it is absent, the failure regex now matches stderr only via a new stderr_text() helper; stdout can no longer manufacture a failure. Genuine failures surface on stderr (command not found, tracebacks, non-zero-exit error streams) and are still caught.

Verification

• stdout contains failure vocabulary, no exit code -> clean (was a false positive)
• exit_code 0 with scary stdout -> clean
• real stderr error, no exit code -> still flagged
• non-zero exit -> still flagged
• Existing test_gate.py (6/6) and test_gate_robustness.py (12/12) pass.

One file changed: scripts/gate/parse_tool_result.py.