feat(oath): gate cad-atlas's own real candidate, not swedsl's toy stub (#8)

oathcandidate/ is a separate Go module (mirrors swedsl's own
oath/testdata/selfcandidate pattern, keeping var-go's transitive deps
out of the deployed atlas binary) whose Build() parses the committed
.gitea/workflows/cd.yml and checks the "oath" job exists and invokes
cmd/vargo-gate. TDD: passes against the real file, fails closed on a
fixture missing the job.

Rewires the oath CI job to go-run vargo-gate from its real module path
(git.d-ma.be/mathias/swedsl/oath/cmd/vargo-gate@oath/v0.28.0, unblocked
by swedsl#35/#38) against VARGO_CANDIDATE_DIR=oathcandidate, instead of
checking out swedsl and gating its hardcoded toy fixture. Private-module
auth via a short-lived GIT_ASKPASS script (token never in argv, never
written to git config, matches act_runner's env:-block-with-secrets
gotcha).

Discovered along the way: var-go's parser needs single-line,
period-separated oath sentences with no Given/When/Then/And keyword
stripping — this repo's older oaths (incl. #1) used an unverified
multi-line keyword-prefixed style. #8's oath uses the proven format.

Still not required by branch protection pending a real-PR confirmation.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.context/PROJECT.md

@@ -54,16 +54,14 @@ assessor-loop ledger) → `06 PR → CI` (go test/vet/lint/govulncheck + **var-g
 
 This repo is built *through* the workflow it depicts. It is `dispatch-allow`-enabled, and its
 own build increments are governed by a **var-go Oath** embedded in their spec issues (see the
-Stage-03 tracking issue). Bootstrapping honesty (per swedsl honest-stub discipline): `cmd/vargo-gate`
-is wired into `.gitea/workflows/cd.yml`'s `oath` job (issue #1, verified with a real PR) — it runs
-on every pull_request, fetches the linked issue's oath, and posts a `var-go/oath` commit status.
-But its candidate is still swedsl's hardcoded toy self-test registry, not cad-atlas's own — it
-fails closed against any real oath. var-go's Executor/Reviewer path is **not** the blocker (that
-was explicitly killed by swedsl's ADR-0002, swedsl#27 — var-go is gate-only by design, each
-consumer supplies its own candidate). The real blocker is `swedsl/oath`'s import path
-(`swedsl#35`); once fixed, cad-atlas writes its own candidate (`#8`). The status is **not**
-required by branch protection, so it can't block merges yet. Disclosed in the CI config comment,
-this doc, and `docs/INCEPTION-OATH.md`.
+Stage-03 tracking issue). `cmd/vargo-gate` is wired into `.gitea/workflows/cd.yml`'s `oath` job —
+on every pull_request it fetches the linked issue's oath and gates cad-atlas's **own real
+candidate** (`oathcandidate/`, #8): it parses the committed `.gitea/workflows/cd.yml` and checks
+the `oath` job actually exists and invokes `cmd/vargo-gate`, then posts the `var-go/oath` commit
+status. This is a real check (TDD'd: passes on the real file, fails closed on a fixture missing
+the job), not swedsl's toy self-test stub — swedsl#35 (import path) and swedsl#38 (real-candidate
+subprocess gating) unblocked it. Still **not** required by branch protection until proven green on
+a real PR (#8). Disclosed in the CI config comment, this doc, and `docs/INCEPTION-OATH.md`.
 
 ## Brain references (source of truth — `brain_get <path>`)