fix(dag): reject ungated reporting checkpoints at authoring

[LeXwDeX]

Incident (issue #320)

2026-08-17: a hand-authored 15-node DAG ran 75 minutes to completed although every decision checkpoint returned verdict: replan. Five checkpoint/stage pairs were wired with depends_on only — no condition — so each next stage spawned ~12ms after its checkpoint settled. The report_to_parent wake to the parent was terminal-only advisory signal, never a gate.

Design decisions

• A report_to_parent: true node with dependents is a reporting checkpoint; each dependent must gate on its output via condition (input_mapping does not count), or the checkpoint must be a reporting leaf, or the node must drop report_to_parent. node_defaults.report_to_parent is honored.
• New checkpointGateDiagnostics wired ONLY into validatePostCompile's structural branch — the authoring start/validate path. Each ungated dependent emits one error-severity dag.invalid diagnostic in both portable and environment profiles.
• Enforcement is authoring-only by design: Dag.create/replan/extend paths untouched to preserve wake-chain + reopen-extend semantics (issue spec(dag): unblock the REJECT checkpoint — a rejected review completes the workflow (A1) #294).
• Rejected alternatives: runtime enforcement (verdict vocabulary open; ACCEPT path must not wait for parent; would change every existing graph), warning severity (the authoring model ignores warnings — that is how the incident happened), new gate field (condition already expresses gating).
• Deferred without date: replan/extend fragment coverage gap; deprecation of advisory wake chains.

Docs

• CONTEXT.md: Reporting Checkpoint glossary row + gating invariant.
• ADR-0003: Reporting checkpoint gating at the authoring boundary.
• Workflow tool routing description: one-line compose guidance for reporting checkpoints.

Acceptance evidence

• 6 new tests in test/dag/dag-checkpoint-gate.test.ts, all passing.
• Incident-spec replay (5 checkpoint/stage pairs) rejected with exactly 5 diagnostics.
• Full dag suite green: 556 tests across 50 files.
• bun typecheck clean (tsgo --noEmit).
• Audit: 14 curated block workflows unaffected; only ultra-flow-route.yaml + release-route.yaml hit, tracked in opencode-dag-config#14.