CI RED: unified-gate.yml requires forjar on PATH but runner lacks it

[noahgift]

Bug

CI badge is RED. The unified / cpu-gates job fails with forjar: not found (exit 127).

Five-Whys Root Cause

1. Why did CI fail? forjar: not found on runner at _provision make target
2. Why is forjar not found? Binary missing from ~/.cargo/bin/ on mac-server — stale .crates.toml manifest
3. Why does CI need forjar on the host? PR ci: update CI, release, and nightly workflows #48 switched from sovereign-ci.yml (container-based, self-contained) to unified-gate.yml (host-based, calls forjar apply via clean-room Makefile)
4. Why was alimentar switched? deploy-workflows.sh generated new ci.yml from template calling unified-gate.yml
5. Why doesn't unified-gate ensure forjar is available? No install step — workflow assumes forjar is pre-installed on runners

Root Cause

deploy-workflows.sh template switched repos from containerized sovereign-ci.yml (where tools are baked into the image) to unified-gate.yml (which depends on host-installed forjar). The binary was lost from mac-server's PATH.

Fix

Re-install forjar on mac-server AND add forjar availability check to unified-gate.yml.

Refs

• Breaking change: PR ci: update CI, release, and nightly workflows #48 (merged 2026-04-05)
• Template: infra/machines/clean-room/templates/ci.yml
• Makefile: infra/machines/clean-room/Makefile line ~520