One skip pattern, two consumers, and a gate that never opened its spec

Issue #1460 (closes), EPIC B residue #3307. Three CI-gate items from the v10 convergence tail, one PR.

What moved where

before (#1458)	after
`bin/git-hooks/pre-push` carried the alternation, plus release-please and Dependabot checks with "mirrors version-check.yml" comments	sources `scripts/ci/version-skip-pattern.sh`, refuses to decide if `VERSION_SKIP_PATTERN` is empty or the file is unreadable
`.github/workflows/version-check.yml` carried the same three checks with "must stay in lock-step" comments	the step sources the same file from the checkout, same guard, `::error::` on empty
`test_skip_regex_parity` extracted the alternation from both files and asserted equality	asserts the file defines the pattern with the expected behaviour (13 skip shapes, 5 enforce shapes), that each consumer sources it, and that neither carries an inline alternation
no fault arm	`tests/ci/fault-arms/version-skip-pattern.sh`: hook and extracted workflow step, file present, emptied, missing

Why the guard: an empty ERE is a compile error that bash [[ =~ ]] reports as no match (rc 2 on /bin/bash 3.2, rc 1 on bash 5). A blank pattern would have silently enforced the bump on every branch, the inverse of the #1457 ghost-version failure.

Try a branch name

The same pattern the file exports, evaluated here. Skipped branches never reach the version comparison; enforced ones must bump plugin.json above origin/main.

branch name

VERSION_SKIP_PATTERN='^(docs|chore|ci|style|test|feat|fix|perf|refactor|issue|bug)/|^release-please|^dependabot/'

Fault arms, measured 2026-09-06

gate	arm	before	after
version-skip-pattern	hook + workflow step, release-please branch (control)	n/a (new)	0 / 0
version-skip-pattern	pattern file emptied	n/a (new)	1 / 1
version-skip-pattern	pattern file missing	n/a (new)	1 / 1
verify-cc-keys	spec present (control)	0	0
verify-cc-keys	spec emptied	0 (passed on nothing)	2 CANNOT OBSERVE
verify-cc-keys	spec missing	0 (passed on nothing)	2 CANNOT OBSERVE

The verify-cc-keys control uses a fixture binary that names every event the allow-list asserts, so the arm runs the same in CI (which installs no Claude Code) and does not depend on whichever binary a host pins, the 2026-08-10 "passed against an older binary with nothing to compare" shape.

Re-check

bash tests/unit/test-pre-push-hook.sh        # Test 4: one source
bash tests/ci/test-fault-arms.sh             # 11 probes, RESULT lines
npm run verify:cc-keys                       # needs a CC binary on this host