The build and release gate

The justfile dispatches; src/capsem/gate/ decides. No recipe carries a shell body, none exceeds five lines, and both are contract tests rather than conventions.

just test is one process, one machine lock, one workspace, one plan. Its dry run reports the current totals; conditional asset staging makes a literal step/action count depend on machine state. Release commands self-qualify in hosted lanes and never require this optional local journal.

The rule everything else follows from

A plan action may never invoke just or another capsem-gate command.