fix(gate): fire failure nudge only on machine-confirmed status

[AnswerTheo]

Closes #14.

Problem

The PostToolUse observation gate fires fablize gate observed a tool failure on successful commands whose output merely contains a failure-looking word (No such file or directory, failed, error:, N errors). In practice this misfires constantly on exit-0 commands: grep results, log/file reads, and remote (SSM/ssh) runs.

Root cause

The host's Bash PostToolUse payload carries no exit_code/exitCode/returncode/status/success field, so exit_success() always falls through to FAILURE_RE.search(text) — a pure text guess. detect_failure() then flags any exit-0 command whose stdout contains a failure keyword. Edit/Write are affected too when the edited text itself contains such words.

Fix

Split machine-readable status (explicit_status()) from the text guess, and gate the failure nudge on ground truth only. exit_success() keeps its text fallback for verification-command bookkeeping, so should_block_stop() is unaffected. If a future host exposes a real exit code, explicit_status() picks it up automatically.

Verification

• Before/after on hooks/gate_post_tool.py:
  • benign exit-0 + No such file or directory → was firing, now {}
  • grep output containing failed/error: → was firing, now {}
  • real failure exit_code: 1 (pytest) → still fires ✅
  • real Edit success: false → still fires ✅
• Regression suites pass: tests/test_gate.py (6/6, incl. S3 pytest-exit-1 → BLOCK) and tests/test_gate_robustness.py (12/12).