agent-preflight silently SKIPS commit-trailers when the branch is behind main, and still prints "All gates green"

[localai-bot]

What

scripts/agent-preflight.sh:218-224 gates the commit-trailers check on
origin/main being an ancestor of HEAD:

if git rev-parse --verify -q origin/main >/dev/null 2>&1 &&
   git merge-base --is-ancestor origin/main HEAD &&
   [ "$(git rev-list --count origin/main..HEAD ...)" -gt 0 ]; then
  echo "Commit trailers vs origin/main:"
  run "commit-trailers" python3 scripts/check-commit-trailers.py --range "origin/main..HEAD"
fi

A branch that is merely behind main — the normal state of any branch opened
before someone else merged — fails that predicate. The block is skipped, and
preflight still prints "All gates green." Nothing in the output says trailer
enforcement did not run.

Observed on PR #642 (base a20cdac30, main at cefacd2d0): preflight exit 0,
"All gates green", commit-trailers never executed. Run explicitly over
a20cdac30..HEAD it is exit 0 — so no defect shipped, but only by luck: the same
green would have been printed over a commit missing FOLLOWING_AGENTS_PROTOCOL
or carrying a forbidden Co-Authored-By.

Why the guard exists, and why it is too strong

The --is-ancestor test is presumably there so the range is well-defined. But it
conflates two different things:

• main is not an ancestor because HEAD is stale — the range
  origin/main..HEAD is still exactly "this branch's own commits", which is
  precisely what should be checked.
• divergent / unrelated histories — where the range is genuinely meaningless.

Only the second warrants skipping. git merge-base origin/main HEAD gives the
right base for the first, and <merge-base>..HEAD is the range that always means
"the commits this branch adds".

Same silence class as #632

A gate that does not run is indistinguishable, in the output, from a gate that
passed. That is the shape #632 records for line anchors and #646 for the orphaned
check-windows-portability.py. Three instances now, all found in one campaign,
all of the form "green does not mean checked".

The cheapest half of the fix is independent of the predicate: when a conditional
gate is skipped, say so. SKIPPED: commit-trailers (origin/main is not an ancestor of HEAD) costs one line and removes the false confidence entirely.

Scope

1. Use git merge-base origin/main HEAD as the range base so a merely-stale
   branch is still checked.
2. Print an explicit SKIPPED: line for any conditional gate that does not run,
   here and anywhere else in the script with the same shape.

Changing what a gate enforces needs a red-before demonstration per AGENTS.md: a
branch based one commit behind main, carrying a commit with no trailers, is
currently green and must go red.

Found during a scoped re-review of #642/#643.