Adds `make todo-gate`, an optional check that asks a System One decision model
whether a committed change delivers an unchecked TODO.md entry it does not
remove. Code owns the policy, including whether TODO.md was touched; the model
only compares the diff with the listed entries. Both inputs are read from the
committed revision. The script is stdlib-only, stays out of `make check`, and
skips itself when OPENROUTER_API_KEY is unset.

The 0.6 threshold comes from replaying 17 recent commits: changes that left
TODO.md alone scored at or below 0.36, and the change that completed a listed
entry scored 0.86. Candidate changelog and guide-update questions were measured
on the same commits and dropped, because their touched and untouched scores
overlapped and no threshold separated them.

Untrusted inputs are bounded: probabilities and the configured threshold must be
finite values in [0, 1], and the response payload and usage shapes are validated
before use.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>