feat(workbench): requirement 003 with the gates and register contracts

Requirement 003 Operator Workbench (operator-confirmed 2026-11-11) and the contracts its work packages build on: gates.py keeps gate rules, branch parents and gate receipts in ~/.local/state/agents-council/gates.db (resolve takes the branch's own level, else the strictest of all parents; derive records the nearest ancestor tips; tree hashes everything a worktree holds through a temporary index). rasci.py gains --unpin, stamps every changed row with updated, and ranks a task after its after-dependencies.

🎯 Fix: 95 %
💥 Break: 3 %
💸 Cost: 100 %
⏱️ Time: 100 %
🛡️ Security: 100 %
🏆 Score: 92
🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 %

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_rasci.py

@@ -166,6 +166,22 @@ class TestRasci(unittest.TestCase):
         rows = json.loads((self.root / "rasci.json").read_text(encoding="utf-8"))
         return {task: row["after"] for task, row in rows.items() if "after" in row}
 
+    def test_unpin_drops_the_pin_a_change_stamps_only_its_row_and_the_rank_follows_after(self):
+        rows = lambda: json.loads((self.root / "rasci.json").read_text(encoding="utf-8"))
+        self._out("set", "work/a", "--prio", "1", "--worker", "One")
+        self._out("set", "work/b", "--prio", "2", "--worker", "One")
+        self.assertEqual(self._out("agents")[0].split("\t")[3], "work/a, work/b")
+        self._out("set", "work/a", "--after", "work/b")
+        self.assertEqual(self._out("agents")[0].split("\t")[3], "work/b, work/a")
+        stamped = rows()["work/a"]["updated"]
+        self._out("set", "work/b", "--unpin")
+        self.assertNotIn("prio", rows()["work/b"])
+        self.assertEqual(rows()["work/a"]["updated"], stamped)
+        self.assertIn("updated", rows()["work/b"])
+        refused = self._run("set", "work/b", "--unpin", "--prio", "3")
+        self.assertEqual(refused.returncode, 2)
+        self.assertIn("--unpin", refused.stderr)
+
     def test_after_stores_and_drops_a_dependency_and_refuses_unknown_tasks_and_cycles(self):
         for task in ("work/a", "work/b", "work/c"):
             self._out("set", task)