ci: add the CI / check workflow the release check reads (REL-1c)

.agents/policies/INDEX.md

@@ -8,7 +8,7 @@
   never(commit|push): --no-verify|-n
   if(hook_fails): fix_issue; never(skip_hook)
 
-## Gates — enforced automatically at commit/push
+## Gates — enforced automatically at commit/push, and in the agent where noted
 
 - **protect-main-branch**: Direct commits/pushes to a protected branch (main|master) are blocked. Create a feature branch and open a pull request.
 

.agents/policies/block-no-verify/skills/block-no-verify/SKILL.md

@@ -16,4 +16,4 @@ never(commit|push): --no-verify|-n
 if(hook_fails): fix_issue; never(skip_hook)
 ```
 
-This skill is advisory: the client reading it has no mechanism to enforce it, and this policy stays advisory even when compiled by `chock` -- it ships rule text, not a blocking hook. See https://github.com/open-coder-ai/chock
+This skill is advisory: the client reading it has no mechanism to enforce it. The same policy compiled by `chock` can refuse an agent's shell command before it runs. See https://github.com/open-coder-ai/chock

.agents/policies/protect-main-branch/skills/protect-main-branch/SKILL.md

@@ -16,4 +16,4 @@ on(commit|push): block(forbidden_ref) refs=main|master
 Direct commits/pushes to a protected branch (main|master) are blocked. Create a feature branch and open a pull request.
 ```
 
-This skill is advisory: the client reading it has no mechanism to enforce it. The same policy compiled by `chock` becomes a git hook that exits non-zero. See https://github.com/open-coder-ai/chock
+This skill is advisory: the client reading it has no mechanism to enforce it. The same policy compiled by `chock` blocks at commit and at push. See https://github.com/open-coder-ai/chock

.chock/bin/launch.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+# chock hook launcher. Every agent hook chock writes runs:
+#   git -c "alias.chock-hook=!test -f <this> || { ...; exit 2; }; sh <this>" chock-hook <runtime.py> [args...]
+# git runs the alias from the repository's top level under its own sh (bash, PowerShell
+# and cmd.exe all pass that string through unchanged), so relative paths resolve and no
+# absolute interpreter path is ever committed. This script picks the first Python that
+# actually runs: `chock.python` (written into .git/config by `chock sync`), then PATH.
+# A candidate must execute, not merely exist: Windows' python3.exe Store alias exists and
+# exits 9009. With no working Python it refuses (exit 2) and says why -- never allows.
+runtime="$1"
+shift
+configured="$(git config --get chock.python 2>/dev/null)"
+# The recorded interpreter is probed like the rest: a venv whose base Python was removed
+# still exists, and exec'ing it exits non-zero without a verdict, which agents let through.
+for candidate in "$configured" python3 python py; do
+    if [ -n "$candidate" ] && "$candidate" -c 'import sys; sys.exit(sys.version_info < (3, 11,))' </dev/null >/dev/null 2>&1; then
+        exec "$candidate" -X utf8 "$runtime" "$@"
+    fi
+done
+echo "chock: no working Python 3.11+ found (tried chock.python, python3, python, py), so this hook cannot check anything. Install Python, or point chock at one: git config chock.python /path/to/python" >&2
+exit 2