feat(devx): the changeset gate answers whether the LEVEL fits the surface, not only whether it is major (#16264)

`Check Changeset` was green on `patch` and green on `minor` for the same diff:
measured on PR #16044, heads `e0938d3fdce` and `98179cae022`, a source tree that
`git diff` reports as differing in exactly one changeset path and, inside it,
one word. Every level-sensitive gate passed both. On that axis the job's green
could not fail, so it carried no information about the level while looking
exactly like a green that does.

`check-changeset-no-major.mjs` now reads a second axis beside the major guard:
when the PR DECLARES clause ② -- the `needs:contract-review` carrier, or the
fixed `Clause-②: yes` line, read through `check-clause2-carriers.mjs`'s own
`readClause2Line` rather than a second spelling -- a `patch` entry for any
package whose `packages/*/src/**` the diff moves is refused. Nothing new is
asked of an author: both declarations already existed in the same PR and were
never compared, and the refusal can only fire while the carrier already holds
the PR outside the merge queue.

The declaration is read from the `pull_request` payload CI already has on disk,
so the gate makes no API call and needs no token; `--event FILE` names that
payload for an offline run. No workflow file changes: the real scan is already
wired per PR in pr-automation.yml's `Check Changeset` job.

Driven on the two real heads, not only on fixtures: `patch` exits 1 naming
`@objectstack/cli` and the changeset, `minor` exits 0, and the same `patch` head
with the carrier stripped reads NOT MEASURED -- a missing reading, never a pass.


Claude-Session: https://claude.ai/code/session_01Vbw3RPgdtqesx4azk9SbW8

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]