feat(api): add has_gates flag and PolicyGatesFilter to workflow run list

Surfaces whether a run had gates in effect (any policy marked gate:true
or contract using ENFORCED strategy) on both PolicyStatusSummary and
WorkflowRunServiceListRequest. Independent of policy status — a PASSED
run can still have has_gates=true. Materialized on workflow_run via a
partial index so the list filter is cheap.

Also refactored the renderer backfill for historic envelopes to a single
pass that derives skipped/passed counts and gate presence together.

Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Author: migmartri

app/controlplane/api/controlplane/v1/response_messages.pb.go

@@ -143,6 +143,17 @@ message PolicyStatusSummary {
   int32 skipped = 4;
   // Total number of violations across all evaluations
   int32 violated = 5;
+  // Whether this run had gates in effect — any policy marked gate:true or
+  // the contract using the ENFORCED blocking strategy. Independent of status:
+  // a PASSED run can still have has_gates=true.
+  bool has_gates = 6;
+}
+
+// Server-side filter aligned with PolicyStatusSummary.has_gates.
+enum PolicyGatesFilter {
+  POLICY_GATES_FILTER_UNSPECIFIED = 0;
+  POLICY_GATES_FILTER_WITH_GATES = 1;
+  POLICY_GATES_FILTER_WITHOUT_GATES = 2;
 }
 
 // Server-side filter aligned 1:1 with PolicyStatus values.

app/controlplane/api/controlplane/v1/response_messages.proto

@@ -220,6 +220,9 @@ message WorkflowRunServiceListRequest {
   PolicyViolationsFilter policy_violations = 6 [deprecated = true];
   // by canonical policy status
   PolicyStatusFilter policy_status = 7;
+  // by whether the run had gates in effect (either a policy marked gate:true
+  // or the contract using the ENFORCED blocking strategy)
+  PolicyGatesFilter policy_gates = 8;
   // pagination options
   CursorPaginationRequest pagination = 2;