feat(pr_merge): gate it like tbd_ship — green CI, unprotected base, exactly one risk/low issue (#74) (#76)

Co-authored-by: Mathias <mthbqv@gmail.com>

docs/HOW_GITEA_MCP_WORKS.md

@@ -125,12 +125,21 @@ by area:
 | Search / Templates | code_search, create_project_from_template |
 | Composite | tbd_ship (trunk-based ship helper) |
 
-**`tbd_ship` merge gate (gitea-mcp#63).** A PR is squash-merged only when ALL of: the head commit's CI is fully green,
-the base branch is not review-protected, and the issue named in `issue` carries **exactly one** `risk/` label, `risk/low`.
-No `issue`, no `risk/` label, several, an unknown value (`risk/lowish`), `risk/medium`, `risk/high`, or an issue that
-cannot be read all fail closed: the PR is opened, `merged:false`, with a `reason` and the `risk` tier in the result.
-Unclassified is not low. Limit: the gate enforces the tier of the issue the caller names; it cannot prove that issue is
-the one the change belongs to, so the link is the caller's claim (the convention in local-dev rule 5 still applies).
+**Merge gate: `tbd_ship` (gitea-mcp#63) and `pr_merge` (gitea-mcp#74).** The two merge tools share one gate
+(`evaluateShipGate`). A PR is merged only when ALL of: the head commit's CI is fully green, the base branch is not
+review-protected, and the issue named in `issue` carries **exactly one** `risk/` label, `risk/low`. No `issue`, no
+`risk/` label, several, an unknown value (`risk/lowish`), `risk/medium`, `risk/high`, or an issue that cannot be read
+all fail closed: nothing is merged, the result is `merged:false` with a `reason`, the `ci_status` and the `risk` tier.
+Unclassified is not low. Above `risk/low` a human reviews and merges in the Gitea UI (which this gate does not touch).
+`pr_merge` additionally fails with an error, merging nothing, when the PR or the base's branch-protection state cannot
+be read. A merge conflict is still an error.
+Both tools bind the merge to the head commit whose CI the gate evaluated (`head_commit_id`), so a push to the PR
+branch after the check makes Gitea refuse the merge instead of merging unchecked code.
+
+Limits: the gate enforces the tier of the issue the caller names; it cannot prove that issue is the one the change
+belongs to, so the link is the caller's claim (local-dev rule 5's convention still applies). Not gated: merging in the
+Gitea UI, and `file_write_branch` committing directly to a branch (`main` included), which is how `risk/low` work
+reaches trunk. Platform-level enforcement for those is branch protection on `main` (local-dev#27 option 2).
 
 Shared tool-layer hygiene (`internal/tools/tool.go`):
 - **Alias normalization** — `repo`↔`name` and `number`↔`index` are reconciled so