fix(records): report gate workflow scan faults

[randomparity]

Summary

• preserve and classify git grep status while deriving protected workflow paths
• fail closed with E-GATE-PATHS-SCAN when the base-ref workflow search faults
• cover scan faults and option-shaped checker basenames with PATH-stubbed regressions
• keep the shipped tome-of-lore assets byte-identical and bump the plugin patch version

Verification

• BASE_SHA=$(git merge-base HEAD main) just verify
• managed pre-push verification

Closes #89

[randomparity]

verdict: approve
exit: none
findings: 0
iterations: 1
security: approve
delivered-head-sha: 7f7bd9a

Forge whole-branch review

forge review: not required (cast mode for the verified governed-small-change)