[AlexNegrescu26]

Why

The sync workflow opened its PR and squash-merged it in the same step, after check-port.sh alone. PRs #19 and #32 landed 3 to 4 seconds after they opened, and no gate.yml run checked either one. The smoke also pinned an omp six releases old, and some scripts and suites had no CI step.

What changed

• gate.yml takes a workflow_call input ref. upstream-sync now runs three jobs. sync builds, pushes, and opens the PR. gate calls gate.yml on the sync commit. merge needs both to pass and the PR head to still match the gated commit.
• gate.yml syntax-checks every tracked *.sh, runs bun test ./extensions, and adds a statechart job on Node 22.
• The smoke pins omp v18.14.1. Bun moves to 1.4.4 and actions/checkout to v7. PORTING.md describes the new sync gate and moves two re-confirmed omp versions to 18.14.1.

Scope

• The gate checks the sync commit, not the squash result. If main moves while the gate runs, the merged tree is not gated.
• The statechart job skips the 67 cases that need TLC and runs no typecheck.
• The smoke script is unchanged.

Tradeoffs

• The statechart job runs the package's own npm test and installs the fast-check pin from its package.json. A second copy of the command and the version in the workflow would drift from the package.

Blast Radius

Only CI changes. A clean sync now waits for the full gate.yml before it merges. A red gate leaves the PR open, and later syncs stop at the open-PR guard until someone resolves it.

Verification

• actionlint 1.7.12 on both workflows: no errors. A copy with a wrong input name and a wrong output name fails with three errors, so the lint checks the call contract.
• npm install --no-package-lock and npm test in a scratch copy of the statechart skill: 334 tests, 267 pass, 67 skip, 0 fail, 53 s.
• sha256sum --check on the downloaded v18.14.1 asset: OK. With that binary on PATH, smoke-plugin.mjs passed with 60/60 skills, and test-worktree-audit.sh with OMP_AUDIT_LIVE_REQUIRED=1 passed.
• bash omp-port/check-port.sh: PASS. bun test ./extensions: 15 pass. The new loop parsed all 7 tracked shell scripts.
• Not run: the workflow_call path and the merge job. A workflow_dispatch of upstream-sync with no sync PR open would run them, and on success it merges into main.