[nikolasd]

A recognized vendor first-run gate (workspace trust, a theme picker, sign-in) no longer fails a run
outright. wait_for_readiness now journals a typed FirstRunGateDetected { kind } event, raises the
paired EscalationRaised { reason: "vendorFirstRunGate" } with a runtime-authored question
naming the vendor and the specific gate, and keeps polling classify_surface on no deadline of its
own until the surface resolves to PromptReady (the ordinary paste/Enter path resumes unmodified) or
the process exits (the existing exit watcher reports it, naming the gate that was blocking the run).
The escalation journals exactly once per distinct gate even though the same gate classifies on every
poll tick until it resolves.

The escalation's database side effect -- inserting the escalations row and raising
EscalationRaised transactionally with the event append -- reuses the exact second-mutation shape
the existing write-violation escalation already has inside the adapter event sink, rather than a new
bespoke call path. This is also the first production call site to populate
EscalationRaised.question.

The milestone digest for escalationRaised previously rendered only reason, never question -- a
bug dormant since no production call site had ever populated the field until now. It now appends
question after reason when present, and renders exactly the previous sentence when it is absent.

Parking a run at a gate on no deadline surfaced a real, separate defect: cancel() and dispose()
both open by acquiring the same lock the readiness poll now holds for as long as it runs, so a run
parked at a gate could never actually be cancelled -- the poll waits for an exit only cancel can
cause, and cancel waits for the poll. Fixed with a lock-free, per-run CancellationToken: cancel()
and dispose() fire it first, before touching that lock; the poll gains one new arm racing it
alongside the existing exit-watcher arm. Firing the token unconditionally, for every cancel scope
including a plain turn-interrupt, is a deliberate widening of that scope's ordinary meaning in this
one window: parked at a gate there is no turn in progress to interrupt, so the only coherent reading
of "stop" is to stop waiting for the gate, and the alternative (a turn-interrupt cancel blocking
behind the same unbounded poll) is worse -- a caller that never returns.

Testing: a fixture-driven replay of a real captured gate proves the escalation fires exactly once and
that a forced process exit names the gate; a deterministic test vendor proves a gate that clears after
a few ticks resumes readiness normally; two database-level tests prove the full journal path for both
a claude and a codex gate, including the exact question wording; the cancellation fix is verified as a
genuine regression control by removing the new select arm and confirming the test fails by timeout
rather than trusting the code.