fix(ci): 실행되지 않거나 실패할 수 없던 CI 게이트 정상화

가장 큰 것: 문서화된 아키텍처 게이트가 규칙을 하나도 실행하지 않았다.
워크플로 7곳과 CLAUDE.md 가 --tests '*CleanArchitectureTest' 를 지정했으나
그 이름의 클래스는 존재하지 않는다. 4곳은 매칭 0건으로 하드 실패하고,
3곳은 다른 필터와 병기돼 아키텍처 규칙 0개를 돌고 초록으로 통과했다.
필터를 패키지 글롭 dev.caskeleton.bootstrap.architecture.* 로 교체했다.
*ArchitectureTest 글롭은 20개 중 12개만 잡고 ArchRuleDiscoveryContractTest 등
8개를 놓치므로 쓰지 않았다.

그 외:
- ci-gate-matrix 의 release_blocking 이 강제되지 않아 trivy-fs 가 빨개도
  release-gate 가 초록이던 것을 실제 의존으로 연결
- build-logic TestKit 이 어떤 CI 에서도 돌지 않던 것을 ci-quality-gates 에 연결
- jpa-next-* 3개, object-storage, fileserver-pr 의 실패할 수 없거나
  트리거되지 않던 잡 정리
- 릴리스 태그 네임스페이스 분열로 v* 태그가 web·websocket 게이트를
  건너뛰던 것 수정
- 워크플로 SHA 잠금 28개 재생성 (verify-gradle-wrapper.sh)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/workflows/ci-quality-gates.yml

@@ -48,6 +48,13 @@ jobs:
       - name: Check quality, public paths, and dependency locks
         working-directory: src
         run: ./gradlew check verifyPublicPathSnapshot verifyDependencyLocks --warning-mode=fail --no-daemon --stacktrace
+      # build-logic is an included build: its own suite is not reachable from the root project's
+      # `check`, so the convention plugins every leaf applies shipped untested in CI. Kept as its
+      # own step rather than folded into the aggregate invocation above, which
+      # ConditionalTransportQualificationContractTest asserts on byte-for-byte.
+      - name: Test the build-logic convention plugins
+        working-directory: src
+        run: ./gradlew -p build-logic test --no-daemon --stacktrace
       # Named as its own step because nothing else runs it: `check` does not depend on
       # graphqlStableTest, so the lane's required-class guard — the check that its module-boundary
       # suite has not silently stopped being discovered — protected nothing in CI. A separate step
@@ -181,6 +188,9 @@ jobs:
       - jpa-candidate-evidence
     if: always()
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      checks: read
     steps:
       - name: Require every current blocking job to succeed
         env:
@@ -203,3 +213,56 @@ jobs:
             fi
           done
           echo "release-gate: all current blocking quality jobs succeeded."
+
+      # `needs` cannot reach another workflow, so every gate .github/ci-gate-matrix.yml marks
+      # release_blocking outside this file was invisible here: the field was read by nothing but an
+      # enum check in verify-gate-matrix.sh. filesystem-vulnerability-scan
+      # (dependency-vulnerability.yml::trivy-fs) is release_blocking: true and blocks on
+      # CRITICAL/HIGH and on the CISA KEV catalogue — it could be red while this job reported green
+      # and nothing in the repository joined the two.
+      #
+      # dependency-vulnerability.yml answers the same pull_request and push-to-main triggers as this
+      # workflow and trivy-fs carries no `if:` guard, so its check run always exists for this SHA.
+      # That is what makes it requirable by result rather than by scheduling luck. Only `success`
+      # passes: a skipped or cancelled security scan is not a scan.
+      #
+      # The other release_blocking gates outside this file (object-storage-qualification.yml,
+      # httpclient-release.yml, messaging-certification.yml) run on triggers this job does not
+      # share, so they cannot be required here without changing when they run. That is left as a
+      # stated gap rather than a silently different one.
+      - name: Require the cross-workflow release-blocking checks to have succeeded
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          COMMIT_SHA: ${{ github.sha }}
+          REQUIRED_CHECKS: trivy-fs
+        run: |
+          set -euo pipefail
+          deadline=$(( $(date +%s) + 1800 ))
+          for required in ${REQUIRED_CHECKS}; do
+            while :; do
+              result="$(
+                gh api \
+                  "repos/${GH_REPO}/commits/${COMMIT_SHA}/check-runs?check_name=${required}&per_page=100" \
+                  --jq '[.check_runs[]] | sort_by(.started_at) | last
+                        | if . == null then "absent none"
+                          else "\(.status) \(.conclusion // "none")" end'
+              )"
+              check_status="${result%% *}"
+              check_conclusion="${result##* }"
+              if [[ "${check_status}" == "completed" ]]; then
+                break
+              fi
+              if (( $(date +%s) >= deadline )); then
+                echo "::error::release-gate: release-blocking check ${required} reported no result for ${COMMIT_SHA} (status ${check_status})"
+                exit 1
+              fi
+              echo "release-gate: waiting for ${required} (status ${check_status})"
+              sleep 30
+            done
+            if [[ "${check_conclusion}" != "success" ]]; then
+              echo "::error::release-gate: release-blocking check ${required} concluded ${check_conclusion}"
+              exit 1
+            fi
+            echo "release-gate: ${required} concluded success."
+          done