Follow-up to #72655: research-before-infrastructure hooks, gate gaps and per-project facts store

@sronix, thank you for testing this properly, and apologies for the three-month silence. I should have answered in July. This is a follow-up to #72655, which is locked, so I'm replying here.

Your findings match how the gate is written, and I'm treating all of them as real bugs:

1. Chained commands. Safe patterns are checked first and return on first match, so gcloud auth list && gcloud run deploy svc passes. Matching per segment after splitting on &&, ; and | is the right fix.
2. ssh and ./deploy.sh. The header says ssh is gated, but the script has no infra pattern for it. Both are missing patterns, and the documentation promises more than the code does.
3. False positives. kubectl apply --dry-run=client and grep -r "docker push" docs/ should not be blocked. Dry-run flags need an exemption, and the match should apply to the command being run, not to text inside arguments.

Your offer of a PR for per-segment matching and the missing patterns is welcome. The gist is public, so anyone can fork it with those fixes: https://gist.github.com/nvst18/891959a227f445b360c3e6af84dcf0ca

On your design question: I agree the gate enforces two things with different lifetimes. Per-session research ("read the current docs before deploying") and settled project facts (server, path, branch, deploy steps) should not share one reset. A durable per-project facts store with timestamps and explicit supersede looks like the right shape to me. I haven't built or tested it, so I can't say how it handles a fact that changes silently.

— Nofyah