A test that only reads the tree never makes a lane's red: OpenAPI coverage, MCP docs, src imports and the README gates join TREE_GATES #8184

Intent: a pull that adds an /api/v1 route with no OpenAPI row (or an MCP tool with no docs/MCP.md row) fails on its own and is reworked, and the sentinel stops calling it "the lane's red" and filing machine-load findings for it (#8140 was one: the test is pure source-reading, passes on main at cd0cc2f6, and went red on three pulls that each added a route).

Done:

• [ ] TREE_GATES in src/checks/shared_red.ts names the tests in test/openapi-coverage.test.ts (all three), test/mcp-docs.test.ts (both), test/src-imports.test.ts ("nothing under src/ imports from outside src/ …") and test/readme-front-door.test.ts (both), each by its exact full name, with one line on why it is a tree gate, in the shape the list already has.
• [ ] test/shared-red.test.ts: three pulls failing "every registered /api/v1 route has an OpenAPI row or is listed as not yet described" within the hour make no shared test and no degraded cause; a test that would pass without the new entries fails.
• [ ] The existing "a test keeps it existing" guard covers the new names (rename a test and the gate test fails).

Files: src/checks/shared_red.ts, test/shared-red.test.ts Risks: an over-broad prefix would hide a real lane red; use full test names, not suite prefixes, except where the whole suite reads only the tree. Fits: @torque (checks and the lane).