Fix the budget gate and add CI, lint and coverage guards

- check_budget.py escalated a hard index-row violation to 'warn' on both
  branches, so INDEX_ROW_HARD could never fail anything. It fails now, and
  tests/unit/test_budget_measurement.py pins both thresholds.
- The corpus note counted scripts/__pycache__/*.pyc, so the same commit
  reported 27 scripts after the suite had run and 16 on a clean checkout.
- TOKENS_PER_CHAR is re-derived from a measurement (26,795 chars -> 6,065
  tokens = 4.418); the comment's old figure and its arithmetic were both
  wrong for this file.
- check_repo.py's yaml sentinel carries the type ignore, so mypy is clean
  with PyYAML installed as well as without it.
- The CPUID test now skips with the probe's own note on a host without
  CPUID instead of failing, and pytest.ini points at tests/README.md, which
  exists, instead of an EXTENSION file that never did.

Tooling: .flake8 (a measured 120-column limit), .gitattributes, .gitignore
and .github/workflows/ci.yml (the five gates, the suite on 3.11-3.14 and a
lint job), which is what CONTRIBUTING.md already claimed CI runs. The
pull-request template it refers to now exists.

Content: pitfalls P26-P34 -- the analysis-level failures the catalogue was
missing (sampling read as observation, a self-built parser trusted, a
verification that could not have failed, a shell-mangled command line) --
registered in the symptom index and its routing mirror. FINDINGS F11-F15
record the defects above.

Tests: the coverage guard derives its subject from scripts/ rather than a
hand-written list, pe_triage.py and pe_diff.py gain their first tests, and
plan.py / preflight.py are declared uncovered with reasons.

README.md

@@ -162,6 +162,13 @@ Six tools live at the root and are not part of the installed skill. Each carries
 Consistency has a natural counter-pressure — a broken path fails loudly and someone fixes it. Bloat
 has none, which is why the budget gate exists.
 
+Those six gates are half of a green run. The other half is `python -m pytest -q` plus the lint pair
+(`mypy` and `flake8` over the same surface, configured by `mypy.ini` and `.flake8`).
+`.github/workflows/ci.yml` runs all of it on every push — the six gates, the suite on Python
+3.11–3.14, and the lint job — and states at the top what it deliberately does not run. A machine
+without the optional dependencies is the environment both the lint configuration and the budget
+gate's fallback path are required to keep working in.
+
 `tests/benchmark.md` holds the regression matrix (dimension -> public target -> scripts exercised ->
 measured result -> strength label), and `docs/tool-verification/` is the evidence record behind it:
 what each script actually did, which independent method confirmed it, and what the target could not