[zaxovaiko]

• ship step 4 now runs the review skill (precheck, risk tier, request trace, evidence gate) instead of starting the three reviewers itself, and pushes only on APPROVED. That self-review is what the MR opens on, so people reviewing the MR read it by hand.
• ship step 7: a thread from the forge's AI review counts like a person's thread, and ship never merges; docs/agents/forge.md says who approves and who merges.
• Testing standard: on a money, KYC, responsible-gambling or authz path, a deliberately broken check must fail at least one test, and a break no test catches holds the merge.

Checks: check:hygiene, oxfmt --check on the changed files, create-openora render test. check:refs reports 19 pointers, none in the changed files (most point at the generated docs/catalog.json).