ci: run the TechLog contract drift gate in CI and test:all

`check:tech-log-contract` existed and worked but nothing ran it. No gate in
`config/ci/gates.json` referenced it and `test:all` did not chain it, so a
hand-edit of the vendored canonical yaml or of `generated.ts` passed every
gate the repository actually executes -- the exact regression the digest pin
exists to prevent.

FE-GATE-010 (architecture/contract governance) now owns the command, beside
`check-registries` and `check-ci`, and `test:all` runs it in front of
`test:tech-log`. The canonical authority baseline moves to 83 command
definitions / 95 references and the gate-shape SHA-256 is recomputed with
`canonicalGateShapeSha256`; the recomputation was first verified by
reproducing the previous constant from the previous gates.json.

`tests/features/tech-log/contract-generation.test.ts` now fails if either
wiring is removed again.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

config/ci/gates.json

@@ -323,6 +323,11 @@
       "expectedExitCode": 1,
       "expectedDiagnosticId": "duplicates routeId=DUPLICATE"
     },
+    {
+      "id": "check-tech-log-contract",
+      "script": "check:tech-log-contract",
+      "expect": "pass"
+    },
     {
       "id": "build",
       "script": "build",
@@ -1950,6 +1955,7 @@
         "check-registries-baseline-fixture",
         "check-registries-fixture",
         "check-routes-fixture",
+        "check-tech-log-contract",
         "check-ci"
       ],
       "logArtifactId": "artifact-artifacts-quality-gates-FE-GATE-010-txt",