The Resilience page shows each THREATS.md protection green, red or untested from the last gate #1963

Replaces #1814 (pulls #1861 and #1938 red; the second on main's release-record fault).

Done looks like:

• [ ] src/web/pages/resilience.ts reads the protections in THREATS.md and the last gate's per-file results; each protection is one line, green, red or "no test yet", naming the test file it cites.
• [ ] Its path is in the reserved names; it ships no stub the hollow-work audit flags.
• [ ] Test: a gate result with the cited file failed marks that line red, and a protection citing no file reads "no test yet".

Start from today's main, at or after 36daece8. The red 'the release record is newest first' on earlier tries was main's own fault (#1837, fixed in 39e98bc9), not the builder's. A new migration is a file src/core/migrations/<UTC yyyymmddHHMMSS>-<name>.ts (see 20261015230000-a-domain-drill.ts), never a number; do not hand-edit src/core/releases.json. Before pushing run bun x tsc --noEmit, the tests this touches, the schema-migrations and schema-additive tests if you add a migration, and test/check-list.test.ts; name every new test file in GATE in scripts/gate.ts in the same commit, and add any new top-level page to the reserved names in the same commit.