fix(gate-67): look for the shipped copy where the runner actually is

[rubenvdlinde]

The gate could only ever skip

gate-67 reported NOT APPLICABLE on every real run — including
openregister#2503, whose entire purpose was to bump the lock to the hydra-gates
version that ships the contracts:

[gate-67] openregister-contract-parity: NOT APPLICABLE — lib/Contract/ exists
but no shipped copy was found to compare it against.

Cause: it looked only in vendor/conduction/hydra-gates/…. The Hydra Gates
job fetches this runner from .github@main and never runs composer install,
so that job has no vendor/ at all — and never will. A gate that can only skip
protects nothing.

Fix

Three locations, in order:

looked up	why it is in the list
vendor/conduction/hydra-gates/…	the consumer's own install — first, so an app pinning an older hydra-gates is judged against what it actually ships
hydra-gates/contracts/	inside the .github repo itself
alongside this script	the copy that travels with the runner — this is the one that works in CI

The ordering is what keeps the acceptance fixtures meaningful: they carry their
own vendor/ copy, which still wins, so planted drift is detected against the
fixture rather than against the real contract.

Verified on the shape CI actually has

openregister's lib/ with no vendor:

before:  rc=4   NOT APPLICABLE
after:   checked 2 file(s)   rc=0
drift:   rc=1, naming the file
leaf app with no lib/Contract:  rc=3

Acceptance matrix unchanged: 161 passed, 0 failed.

Why it was found

I checked the gate's verdict in a real run instead of assuming the lock bump was
enough. A gate that has only ever skipped has not been shown to work — the same
lesson this ADR-084 thread has now produced three times.

🤖 Generated with Claude Code